CVE-2025-11921

Impact

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://bjango.com/mac/istatmenus/
• https://cdn.istatmenus.app/files/istatmenus7/versions/iStatMenus7.10.6.zip
• https://fluidattacks.com/advisories/muse