CVE-2020-25533

An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by leveraging a race condition during crafted use of posix_spawn.

• CWE-362

• https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/Exploit, Patch, Third Party Advisory
• https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/Exploit, Patch, Third Party Advisory

Published

Jan 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2551Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2020-25514Sourcecodester Simple Library Management System 1.0 is affec…8.4
• CVE-2020-25515Sourcecodester Simple Library Management System 1.0 is affec…7.8
• CVE-2020-25516WSO2 Enterprise Integrator 6.6.0 or earlier contains a store…5.4
• CVE-2020-2552Vulnerability in the Oracle WebLogic Server product of Oracl…4.8
• CVE-2020-2553Vulnerability in the Oracle Knowledge product of Oracle Know…4.8
• CVE-2020-25537File upload vulnerability exists in UCMS 1.5.0, and the atta…9.8
• CVE-2020-25538An authenticated attacker can inject malicious code into "la…8.8
• CVE-2020-25540ThinkAdmin v6 is affected by a directory traversal vulnerabi…7.5
• CVE-2020-2555Vulnerability in the Oracle Coherence product of Oracle Fusi…9.8
• CVE-2020-25557In CMSuno 1.6.2, an attacker can inject malicious PHP code a…8.8
• CVE-2020-25559gnuplot 5.5 is affected by double free when executing print_…7.8