mas0nshi/cve-2026-112445Proof-of-concept for CVE-2026-112445, a macOS local privilege escalation where an unprivileged console user abuses the launchd com.apple.xpc.uscwoap job and TIOCSTI to gain root.
In 2020, someone raised a question on GitHub: What is uscwoap? macOS had already switched to zsh, so why did com.apple.xpc.uscwoap still invoke Bash?
A reply showed the job's configuration. It had the BootShell flag set and connected all three standard streams to the console. Based on this, the commenter suggested that the job might be involved in bringing the system up from single-user mode.
The configuration for com.apple.xpc.uscwoap resides in the system LaunchDaemons directory. The relevant fields are shown below:
Label = com.apple.xpc.uscwoap
BootShell = true
ProcessType = Interactive
Program = /bin/bash
ProgramArguments = [bash, -sh]
StandardInPath = /dev/console
StandardOutPath = /dev/console
StandardErrorPath = /dev/console
The job belongs to launchd's system domain and does not specify a less-privileged account to run under, so Bash runs as root. StandardInPath connects its standard input to /dev/console. Bash interprets the input it receives from this device as commands.
A non-administrator account logged into the active graphical console can start this job through launchd's job control interface without administrator credentials. The resulting Bash process runs with UID 0. Despite the BootShell flag, this launch path is also available in a normal desktop session.
The root shell receives its commands from /dev/console. In this graphical login session, the device is owned by the non-administrator account, while the Bash process reading commands from it runs as root. A privilege boundary therefore separates the source of the input from the process executing it.
Terminal output and the terminal input queue serve different purposes: the former displays text, while the latter holds characters waiting to be read by a program. A process that can influence the input queue can therefore influence what Bash reads from standard input.
TIOCSTI is a terminal interface for simulating input by inserting characters into the input queue. On affected builds, a process running under the current console user's account can use this mechanism to influence input on /dev/console. The root shell launched by the system job reads those characters from the same device.
Bash interprets the characters as commands and executes them with its own root privileges. This input path performs no administrator authorization check on the process supplying the characters, allowing input from an unprivileged user to become commands executed as root.
Apple assigned CVE-2026-112445 to this issue, but did not include the identifier in its security advisory. The reason for the omission is unknown.
macOS 27.2 removes the com.apple.xpc.uscwoap configuration.