A race condition in the quarantine and restore workflow of the X‑VPN macOS website allows a local attacker to create or manipulate a symbolic link during concurrent file operations. By exploiting this timing gap the attacker can overwrite privileged files, effectively achieving privilege escalation and compromising system integrity. The CVSS score of 7.3 indicates a high severity of the flaw.

The vulnerability applies to X‑VPN’s macOS website versions 77.0 through 77.5. The affected product is known as X‑VPN macOS website and is distributed by the vendor X‑VPN.

The flaw is local in nature and requires the attacker to have access to the user’s machine to influence the quarantine/restore workflow. EPSS data is unavailable and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no known widespread exploitation at present. Nonetheless, given the high CVSS score, an unpatched system is at significant risk if a local user can trigger the race condition, and the attacker can modify critical system files through symlink manipulation.