An issue was addressed with improved validation of environment variables.

CVE-2024-40842 is a TCC (Transparency, Consent, and Control) bypass in XProtectRemediatorDubRobber, the module within Apple's built-in XProtect Remediator anti-malware framework that scans for DubRobber/XCSSET trojan infections. Because the binary holds com.apple.private.tcc.allow with kTCCServiceSystemPolicyAllFiles (Full Disk Access), a local attacker with standard user privileges can set the MAGIC environment variable to point at a crafted database file before the scanner runs. When libmagic parses the malicious database, it throws errors that embed the contents of TCC-protected *text* files — effectively side-channeling data the user or MDM explicitly denied the app from reading. Binary files (SQLite databases, binary plists, images) cannot be meaningfully exfiltrated this way. The flaw affects all macOS versions prior to Sequoia 15.0, released September 16, 2024.

Apple's MEDIUM / 5.5 rating is reasonable and, if anything, slightly generous. The CVSS vector correctly reflects local access, low privileges, no user interaction, and confidentiality-only impact. But it does not account for the *text-file-only* limitation, which materially constrains what an attacker can actually steal. Contacts, calendars, and Notes stored as plaintext are reachable, but the crown jewels on modern macOS — Keychain (binary), TCC.db (SQLite), and most user photos — are not. The vulnerability is a useful post-exploitation convenience, not a decisive capability.

Why this verdict

• Local-only, post-compromise prerequisite. AV:L means the attacker already has code execution on the Mac. This is a post-initial-access tool, not an entry vector. Every enterprise defender should weight this as a second-stage capability, not a perimeter risk.
• Text-file-only leakage caps the blast radius. The libmagic error-message side channel cannot meaningfully extract binary data. Keychain items, TCC.db, photos, and SQLite databases — the highest-value macOS targets — are immune. This materially reduces the C:H rating's real-world impact.
• No PoC, no exploitation, negligible EPSS. With an EPSS of 0.00229, no public tooling, and no observed campaigns nearly two years post-disclosure, the exploitation probability is de minimis.
• Role multiplier: XProtectRemediatorDubRobber runs on *every* macOS installation (100% installed base) and holds Full Disk Access, making it a security-agent component. However, the vulnerability's outcome is host-scoped text-file information disclosure — not SYSTEM access, not security-agent bypass, not fleet compromise. On a developer workstation (low-value), the impact is minor convenience data leakage. On a managed enterprise endpoint (typical), the impact is limited exfiltration of plaintext documents and contacts — meaningful but not fleet-scale. There is no high-value server role for macOS endpoints where this chain escalates to domain/fleet/supply-chain compromise. The security-agent floor ("bypass equals SYSTEM") does not trigger because the vulnerability does not grant code execution or bypass the scanner's detection function — it abuses the scanner's FDA entitlement for reads only.

Why not higher?

Elevating to HIGH would require either remote exploitability, demonstrated in-the-wild exploitation, or a blast radius beyond a single host. None of these conditions exist. The component *is* a security agent, but the vulnerability does not disable or bypass its malware-detection function, nor does it grant privilege escalation. It is an information-disclosure side channel with significant format limitations.

Why not lower?

Dropping to LOW would undervalue the TCC bypass aspect. TCC is a meaningful security boundary on macOS, and this vulnerability lets an attacker read files the user explicitly denied access to — that is a real privacy and data-protection violation. The Full Disk Access entitlement on the exploited binary means the read scope is broad within the text-file constraint. For organizations handling regulated plaintext data on macOS endpoints, this remains a relevant risk.

1. Upgrade to macOS 15.0 Sequoia or later — The definitive fix. Apple sanitized the MAGIC environment variable in the XProtectRemediatorDubRobber invocation path. Per the noisgate remediation SLA for MEDIUM, deploy within 365 days — but given the patch has been available since September 2024, most fleets should already be on 15.x. Audit for stragglers on Sonoma 14.x or earlier.
2. Audit macOS fleet version compliance — Run an MDM query (Jamf, Kandji, Mosyle, Fleet) filtering for hosts on macOS < 15.0. Any host still on Sonoma 14.x or Ventura 13.x is exposed to this and dozens of other patched vulnerabilities. No mitigation SLA applies for MEDIUM — go straight to remediation.
3. Enable EDR behavioral monitoring for env-var manipulation of system processes — Configure your macOS EDR (CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint) to alert on environment variable injection targeting /Library/Apple/System/Library/CoreServices/XProtect.app and its sub-binaries. This is a low-false-positive detection.
4. Enforce Gatekeeper and notarization strictness — Ensure MDM profiles enforce Gatekeeper to App Store + identified developers with no user override. This raises the bar for the initial code-execution prerequisite. Does not block the vulnerability itself but reduces the attack surface for step 1.

Run on each macOS target host as any user. No elevated privileges required. Example: bash check_cve_2024_40842.sh

#!/bin/bash
# CVE-2024-40842 check — XProtectRemediatorDubRobber TCC infoleak
# Run on macOS target host. No root required.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

MAJOR=$(sw_vers -productVersion 2>/dev/null | cut -d. -f1)
MINOR=$(sw_vers -productVersion 2>/dev/null | cut -d. -f2)
FULL=$(sw_vers -productVersion 2>/dev/null)

if [ -z "$MAJOR" ]; then
  echo "UNKNOWN — unable to determine macOS version (is this macOS?)"
  exit 2
fi

if [ "$MAJOR" -ge 15 ]; then
  echo "PATCHED — macOS $FULL (>= 15.0 Sequoia). CVE-2024-40842 is fixed."
  exit 0
else
  echo "VULNERABLE — macOS $FULL (< 15.0). CVE-2024-40842 affects XProtectRemediatorDubRobber."
  echo "Upgrade to macOS 15.0 (Sequoia) or later."
  exit 1
fi

Sources

1. Apple Security Advisory — macOS Sequoia 15
2. NVD — CVE-2024-40842
3. Gergely Kalman — XProtectRemediatorDubRobber Infoleak Writeup
4. Full Disclosure — APPLE-SA-09-16-2024-2
5. CVEFeed — CVE-2024-40842 Detail
6. Black Hat USA 2025 — XUnprotect: Reverse Engineering macOS XProtect Remediator
7. CIS Advisory — Apple Products Multiple Vulnerabilities (2024-102)