A newly disclosed vulnerability dubbed “Daemon Ex Plist” allows attackers to escalate privileges from standard user to root access on macOS systems, exploiting a timing flaw in how the operating system handles daemon configuration files.
Security researcher Egor Filatov published details of the vulnerability on July 17, 2025, demonstrating how malicious actors can manipulate property list files to gain complete system control.
The flaw targets macOS’s launchd service management system, which uses XML property list (plist) files to define background services called daemons and agents.
During software installation, packages often copy daemon configuration files to /Library/LaunchDaemons/ before adjusting their ownership to root.
Filatov discovered a critical race condition during this process where attackers can modify the plist file after it’s copied but before ownership changes occur.
By inserting a <key>UserName</key><string>root</string> entry and pointing the ProgramArguments array to a malicious script, attackers can create a daemon that executes with root privileges at the next system reboot.
The vulnerability is particularly dangerous because it requires no initial elevated permissions—any standard user can potentially exploit it.
Laboratory testing revealed the exploitation window lasts approximately 1.8 milliseconds on standard hardware, though virtualized environments extend this to 50 milliseconds.
Once successful, attackers gain complete system control, including the ability to disable System Integrity Protection (SIP), manipulate privacy databases, and install persistent backdoors.
The exploit affects enterprise environments where employees install third-party software, mobile device management deployments, and continuous integration pipelines.
Unlike previous macOS privilege escalation bugs that required complex heap manipulation or XPC service abuse, Daemon Ex Plist exploits legitimate functionality through simple XML modifications.
Apple assigned CVE-2025-27981 to the vulnerability and released patches in macOS Sonoma build 23A5290h.
The fix implements ownership verification, preventing launchd from honoring UserName fields in user-owned plist files.
Additionally, Apple introduced an entitlements requirement for writing to system daemon directories, giving third-party developers 90 days to adopt the new security model.
However, older macOS versions including Big Sur and Monterey remain vulnerable, as Apple declined to backport the fixes citing architectural differences.
Organizations unable to immediately upgrade should implement file system monitoring for /Library/LaunchDaemons/ modifications and deploy endpoint detection rules flagging suspicious plist configurations.
Security teams should audit installed packages for vulnerable installation patterns and consider restricting software installation privileges until patches are applied.
The vulnerability highlights broader risks in configuration-as-code paradigms, where the separation between configuration creators and execution contexts can be exploited.
As declarative service frameworks become ubiquitous across operating systems, ensuring robust ownership validation becomes increasingly critical for maintaining system security boundaries.
Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…