A time‑of‑check time‑of‑use flaw in the Trend Micro Apex One agent cache mechanism on macOS allows an attacker who already has local, low‑privileged code execution to gain higher privileges on the device. This vulnerability arises from improper verification of cached data before it is used, enabling an elevated privilege state when exploited. The resulting privilege escalation could permit the attacker to perform system‑level actions such as modifying settings or installing software.

Trend Micro Apex One for macOS (no specific version information available) is affected until the vendor releases an update. The flaw was addressed in mid to late 2025 with ActiveUpdate and SaaS updates (SaaS 2507 & 2005 Yearly Release); any installation that has not yet applied these updates remains vulnerable.

The flaw permits local privilege escalation; an attacker must first obtain low‑privileged code execution on the target system to exploit it. Once local code execution is achieved, it is inferred that the attacker could gain elevated privileges, allowing further system modifications. The EPSS score is not provided and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 7.8 classifies this flaw as high severity. Based on the description, the likelihood of immediate exploitation is uncertain, and the extent to which adversaries may develop payloads remains unconfirmed. Prompt updating mitigates the risk.