CVE-2026-2637

HighPublic PoCLPE

Published: 03 March 2026

Published

03 March 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 7.6th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2637 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Iboysoft Ntfs For Mac. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for access to system resources, directly addressing the ntfshelperd daemon's lack of authentication and authorization on its root-exposed NSConnection service.

AC-6 Least Privilege partial match

prevent

Employs least privilege to ensure privileged processes like ntfshelperd do not grant excessive root access to unauthenticated local connections.

SI-2 Flaw Remediation good match

preventrecover

Requires timely identification, reporting, and correction of the privilege escalation flaw in iBoysoft NTFS for Mac version 8.0.0 via vendor patching.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Local unauthenticated NSConnection in root daemon directly enables unauthorized privileged actions, mapping to exploitation for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks. This issue affects iBoysoft NTFS: 8.0.0.

Deeper analysisAI

CVE-2026-2637 is a local privilege escalation vulnerability in iBoysoft NTFS for Mac version 8.0.0. The issue affects the privileged helper daemon ntfshelperd, which exposes an NSConnection service running as root without implementing any authentication or authorization checks. This flaw aligns with CWE-732 (Incorrect Permission Assignment for Critical Resource) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.

A local attacker with low privileges can exploit the vulnerability by connecting to the unauthenticated NSConnection service exposed by ntfshelperd. Exploitation requires low complexity and no user interaction, enabling the attacker to escalate privileges to root and achieve high impacts on confidentiality, integrity, and availability of the system.

Mitigation details are available in advisories such as Fluid Attacks' report at https://fluidattacks.com/advisories/cuarteto and the vendor's page at https://iboysoft.com/ntfs-for-mac/. Security practitioners should consult these resources for patching instructions and workarounds specific to affected installations.