Intego Personal Backup, a macOS backup utility, contains a local privilege escalation flaw. Backup task definitions are stored in a directory writable by non‑privileged users, while the system processes those files with elevated privileges. A local attacker who can create or modify a serialized task file can induce the backup engine to write arbitrary files to critical system locations, thereby gaining root access. The weakness stems from improper validation or sanitization of user supplied data (CWE‑59).

The vulnerability affects the Intego Personal Backup application; specific version details are not disclosed in the available data. The issue is relevant to any installations that utilize the backup task feature on macOS.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user access and the ability to create or alter backup task files in the writable directory, after which the backup engine—running as root—processes the malicious file and performs arbitrary file writes.