What’s Vulnerable › Vulnerabilities

CVE-2025-11921: iStat Menus 7.10.4 - Local Privilege Escalation

• Severity: high (CVSS 8.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-24 · updated 2026-10-18
• Weakness: CWE-77

Description

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.

Affected products

• Bjango iStats: 7.10.4

References

• https://bjango.com/mac/istatmenus/
• https://cdn.istatmenus.app/files/istatmenus7/versions/iStatMenus7.10.6.zip
• https://fluidattacks.com/advisories/muse

Get alerted when CVE-2025-11921 or the next vulnerability affects your stack