Security News > 2022 > July > Microsoft releases PoC exploit for macOS sandbox escape vulnerability
Microsoft has published the exploit code for a vulnerability in macOS that could help an attacker bypass sandbox restrictions and run code on the system.
The company released the technical details for the security issue, which is currently identified as CVE-2022-26706, and explained how the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine.
"Despite the security restrictions imposed by the App Sandbox's rules on applications, it's possible for attackers to bypass the said rules and let malicious codes"escape" the sandbox and execute arbitrary commands on an affected device" - Microsoft.
Jonathan Bar Or of the Microsoft 365 Defender Research Team explains that the vulnerability was discovered while looking into methods to run and detect malicious macros in Microsoft Office documents on macOS. To ensure backward compatibility, Microsoft Word can read and write files that come with the prefix "~$," which is defined in the app's sandbox rules.
After studying older reports [1, 2] about escaping the macOS sandbox, the researchers found that using Launch Services to run an open -stdin command on a special Python file with the abovementioned prefix allows escaping the App Sandbox on macOS, potentially leading to compromising the system.
Microsoft reported the vulnerability to Apple last year in October and a fix was delivered with the macOS security updates in May 2022.
News URL
Related news
- PoC exploit for Ivanti Endpoint Manager vulnerabilities released (CVE-2024-13159) (source)
- MITRE Caldera RCE vulnerability with public PoC fixed, patch ASAP! (CVE-2025–27364) (source)
- Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks (source)
- Ballista Botnet Exploits Unpatched TP-Link Vulnerability, Targets Over 6,000 Devices (source)
- Microsoft isn't fixing 8-year-old shortcut exploit abused for spying (source)
- Android Malware Exploits a Microsoft-Related Security Blind Spot to Avoid Detection (source)
- BlackLock Ransomware Exposed After Researchers Exploit Leak Site Vulnerability (source)
- Week in review: Chrome sandbox escape 0-day fixed, Microsoft adds new AI agents to Security Copilot (source)
- Attackers are targeting CrushFTP vulnerability with public PoC (CVE-2025-2825) (source)
- Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-05-26 | CVE-2022-26706 | Unspecified vulnerability in Apple products An access issue was addressed with additional sandbox restrictions on third-party applications. | 5.5 |