A time‑of‑check time‑of‑use flaw in the iCore service’s signature verification can let a local attacker who can already run low‑privilege code bypass integrity checks and elevate to higher privileges. The flaw allows the attacker to modify signature data between verification and use, resulting in elevated authority on the host. The problem is bounded to situations where the attacker can execute arbitrary code locally and does not involve network exploitation.

Trend Micro Apex One for macOS, iCore service on macOS. No specific version range is listed, but the issue was corrected in the 2025 ActiveUpdate/SaaS releases (SaaS 2507 and the 2005 Yearly Release). Systems running prior builds remain vulnerable until updated.

The CVSS score of 7 reflects medium severity. EPSS is not available and the vulnerability is not in CISA KEV, suggesting no widespread exploitation has been observed. However, because the attack requires local code execution, the risk is limited to environments where a user or process can already run arbitrary code, but the potential for privilege escalation remains serious. Organizations should treat the vulnerability as high risk if such preconditions exist.