BuhoCleaner 1.15.2 Local Privilege Escalation via PID Reuse Attack (CVE-2026-0924)

This webpage screenshot provides detailed information about a Local Privilege Escalation vulnerability in BuhoCleaner version 1.15.2. Below is a summary of the key information: Vulnerability Overview Vulnerability Name: BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack CVE ID: CVE-2026-0924 Risk Level: High (High) - CVSS v4.0 base score of 7.3 Vulnerability Details Affected Product: BuhoCleaner Discoverer: Oscar Uribe (Fluid Attacks Offensive Team) Disclosure Date: January 30, 2026 Vulnerability Description A vulnerability exists in the privileged helper tool of BuhoCleaner for macOS, allowing any local user to execute arbitrary commands without authentication. The flaw resides in the XPC service and is exploited via a PID reuse attack. Exploitation Method 1. PID Reuse Attack: Attackers can exploit the flag in the system call to bypass code signing validation, leading to a Time-of-Check to Time-of-Use (TOCTOU) race condition. 2. Command Injection: The method accepts a series of shell scripts and directly passes them to for execution, enabling injection of arbitrary commands. Proof of Concept (PoC) A code implementation of the exploit is provided, demonstrating the escalation from regular user privileges to root privileges. References Official product homepage, contact, and download links. Timeline Vulnerability discovered on January 30, 2026; vendor contacted on January 13, 2026; response received on January 15, 2026; follow-up with vendor on January 26, 2026; vulnerability advisory published on January 31, 2026. System Information and Acknowledgments Affected system version: BuhoCleaner 1.15.2, authored by Dr. Buho. Acknowledgments to Oscar Uribe and the Fluid Attacks Offensive Team for discovering and reporting the vulnerability. Mitigation Users are advised to upgrade to the latest version of BuhoCleaner to resolve this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

BuhoCleaner 1.15.2 Local Privilege Escalation via PID Reuse Attack (CVE-2026-0924)