The vulnerability is a time‑of‑check time‑of‑use (TOCTOU) race condition that allows an attacker who already has authorized access to Microsoft Defender for Endpoint for Mac to elevate their privileges locally. By exploiting the race, a user with sufficient local access could potentially gain higher system privileges, enabling the execution of arbitrary code or the modification of protected files. This weakness corresponds to CWE‑367 – TOCTOU.

Microsoft Defender for Endpoint for Mac is the affected product. No specific version information is provided, so all installations of this product are potentially vulnerable until an official update is applied.

With a CVSS score of 5.5, the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited evidence of widespread exploitation. The attack vector is local, requiring an authorized user to trigger the race condition. Once exploited, the attacker can gain elevated privileges on the host, thereby compromising the confidentiality, integrity, and availability of the affected system.