CVE-2019-7249

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-01-31 · updated 2026-06-17
Weakness: CWE-367

Description

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root access) to tamper with another's installs.

Affected products

Zoom Video Communications Inc Keybase Client for Windows: before 2.12.6 — fixed in 2.12.6

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Keybase Client for Windows 2.12.6. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106824
https://hackerone.com/reports/471739
https://keybase.io/docs/secadv/kb004
http://www.securityfocus.com/bid/106824
https://hackerone.com/reports/471739
https://keybase.io/docs/secadv/kb004

Get alerted when CVE-2019-7249 or the next vulnerability affects your stack