CVE-2026-2637
Published: 03 March 2026
Summary
CVE-2026-2637 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Iboysoft Ntfs For Mac. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2637 is a local privilege escalation vulnerability in iBoysoft NTFS for Mac version 8.0.0. The issue affects the privileged helper daemon ntfshelperd, which exposes an NSConnection service running as root without implementing any authentication or authorization checks. This flaw aligns with CWE-732 (Incorrect Permission Assignment for Critical Resource) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.
A local attacker with low privileges can exploit the vulnerability by connecting to the unauthenticated NSConnection service exposed by ntfshelperd. Exploitation requires low complexity and no user interaction, enabling the attacker to escalate privileges to root and achieve high impacts on confidentiality, integrity, and availability of the system.
Mitigation details are available in advisories such as Fluid Attacks' report at https://fluidattacks.com/advisories/cuarteto and the vendor's page at https://iboysoft.com/ntfs-for-mac/. Security practitioners should consult these resources for patching instructions and workarounds specific to affected installations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9287
Vulnerability details
iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks. This issue affects iBoysoft NTFS: 8.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local unauthenticated NSConnection in root daemon directly enables unauthorized privileged actions, mapping to exploitation for privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the ntfshelperd daemon's lack of authentication and authorization on its root-exposed NSConnection service.
Employs least privilege to ensure privileged processes like ntfshelperd do not grant excessive root access to unauthenticated local connections.
Requires timely identification, reporting, and correction of the privilege escalation flaw in iBoysoft NTFS for Mac version 8.0.0 via vendor patching.