CVE-2026-4556
Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool…
- Risk score
- 59/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, en…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
Original description
Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.
Last activity 28 Sep 2026. Patch Forecast updates every hour.