CVE-2025-9815highCWE-287 CWE-306

CVE-2025-9815: high-severity vulnerability in alaneuler batteryKid

alaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authentication

Published 02 Sep 2025

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.3%

A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

alaneuler · batteryKid

References

https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-concepts https://vuldb.com/?ctiid.322142 https://vuldb.com/?id.322142 https://vuldb.com/?submit.641358