BuhoCleaner contains an insecure XPC service that permits a local, unprivileged user to gain root privileges through insecure functions. The flaw involves concurrency weaknesses identified by CWE‑367 (Improper Locking). The result is a local privilege escalation that can compromise system integrity, allowing an attacker to execute arbitrary code as root.

The affected product is Dr.Buho BuhoCleaner version 1.15.2, running on macOS. Only this specific version is known to be susceptible to the local privilege escalation via PID reuse attack.

The vulnerability has a CVSS score of 7.3, indicating a high impact, while the EPSS score is below 1% showing a very low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who has access to the same user account on the affected machine can exploit the insecure XPC service through PID reuse to elevate their privileges to root.