macOS PackageKit LPE via ~/.zshenv sourced under installer root context
macOS PackageKit runs PKG-installer shebang scripts under root, and zsh shebangs source ~/.zshenv from the calling user's home before the script body runs, yielding local privilege escalation. Fixed in macOS Sonoma 14.5 (May 2024).
- Vendor
- Apple
- Product
- macOS PackageKit (Installer.app framework)
- CVSS
- 7.8
- EPSS (exploit probability)
- 1.5%
- Status
- patched
- Published
Is CVE-2024-27822 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2024-27822 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2024-27822 is a local privilege escalation flaw in Apple’s PackageKit framework — the code that runs .pkg installer preinstall and postinstall scripts. When a script uses a #!/bin/zsh shebang, the shell it invokes sources the calling user’s ~/.zshenv before running the script body. PackageKit has already elevated the installer to root by that point, so the .zshenv payload runs as root. Any local unprivileged user who can plant a .zshenv in their own home directory has staged a root payload the next time a PKG installer with a zsh preinstall runs on their session.
Advisory context
Apple patched CVE-2024-27822 in macOS Sonoma 14.5 on 2024-05-14, with parallel fixes in macOS Ventura 13.6.7 and macOS Monterey 12.7.5. NVD scores the flaw CVSS 7.8 (high). Rapid7 shipped a public Metasploit module — osx/local/packagekit_zshenv_privesc — on 2026-07-10, more than two years after the fix; the module packages the .zshenv plant, opens a minimal PKG via Installer.app, and waits for the standard installer authentication dialog. Original research is credited to Mykola Grymalyuk, with the Metasploit contribution from h00die.
What to do
Query the MDM (Jamf, Kandji, Intune) for hosts on macOS 14.4 or earlier (Sonoma), 13.6.6 or earlier (Ventura), 12.7.4 or earlier (Monterey), or any macOS 11.x. Those are the builds the Metasploit module needs. A single host that reboots into a two-year-old point release after an image restore is the whole exposure. Upgrade to the patched point release on each supported line.
Coverage context and the two-abstraction framing alongside the FlowiseAI CSV Agent RCE shipped in the same wrap-up: Metasploit Weekly Adds Flowise CSV, macOS PackageKit. Canonical NVD record: CVE-2024-27822.
Other Apple CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-86950 CoreGraphics memory confusion in Apple iOS 26, iPadOS, macOS 26, macOS 15write-up | [ HIGH ] | 8.8 | 1.2% | |
| CVE-2026-65400 Apple macOS Improper Authentication Vulnerability | [ CRITICAL ] | 9.8 | 1.7% | |
| CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability | [ MEDIUM ] | 5.5 | 0.4% | |
| CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability | [ HIGH ] | 8.8 | 1.7% | |
| CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability | [ HIGH ] | 8.8 | 4.0% | |
| CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability | [ HIGH ] | 7.8 | 2.0% | |
| CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability | [ HIGH ] | 7.8 | 7.0% |
