Race Condition in macOS LaunchDaemons Opens Door to Root Privileges

Apple has patched a critical privilege escalation vulnerability CVE-2025–27981, that affects multiple macOS versions, including Sonoma, Sequoia, and Ventura. The vulnerability, which is rated at CVSS 9.8, stems from a race condition in how daemon plist files are handled during installation and updates. Threat actors can exploit the timing window to inject malicious configuration files, allowing root-level code execution.

The vulnerability was discovered by independent researchers in early 2025, and was silently fixed in macOS Sonoma build 23A5290h and later updates. Apple did not reference the CVE directly in public advisories, reflecting its policy of limited disclosure until patches are widely deployed.

The vulnerability is a textbook example of how improperly synchronized file operations can be chained into full privilege escalation. The exploit path leverages timing discrepancies in LaunchDaemon registration, bypassing SIP protections in specific scenarios.

No public exploit or Proof of Concept (PoC) has been identified yet, but security teams are urged to assume active probing may already be underway. The vulnerability affects systems where installation scripts lack integrity checks for plist file manipulation.

Affected versions:
- macOS Sonoma (pre-build 23A5290h)
- macOS Sequoia (early 15.x builds)
- macOS Ventura (legacy support builds)

Mitigation guidance:
- Upgrade to patched builds listed in Apple’s security releases.
- Monitor `/Library/LaunchDaemons/` for unauthorized plist changes.
- Employ endpoint security tools capable of detecting post-install file system anomalies.

The vulnerability highlights the broader risk of installation-time manipulations, especially in enterprise fleets where scripted provisioning remains common.