CVE-2025-0396: exelban stats XPC Service RCE Vulnerability

CVE-2025-0396 Overview

CVE-2025-0396 is a command injection vulnerability in the exelban stats macOS system monitor. The flaw affects versions up to 2.11.21 and resides in the shouldAcceptNewConnection function of the XPC Service component. A local attacker can manipulate input handled by this function to inject and execute arbitrary commands. Because the XPC Service handles inter-process communication with elevated context on macOS, successful exploitation can lead to local privilege escalation. The issue is tracked under CWE-74: Improper Neutralization of Special Elements in Output. The maintainer resolved the issue in version 2.11.22.

Critical Impact
Local attackers can inject commands through the exelban stats XPC Service, resulting in privilege escalation on affected macOS hosts.

Affected Products

exelban stats versions up to and including 2.11.21
exelban stats XPC Service component (shouldAcceptNewConnection)
macOS systems running vulnerable exelban stats builds

Discovery Timeline

2025-01-12 - CVE-2025-0396 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0396

Vulnerability Analysis

The vulnerability exists within the XPC Service used by exelban stats to broker privileged operations between the user-facing application and helper components. macOS applications commonly delegate elevated tasks (such as reading kernel counters, managing helper tools, or accessing protected sysctls) to an XPC helper that runs with higher privileges. The shouldAcceptNewConnection method is the entry point that validates incoming XPC client connections. Improper validation in this method allows an attacker on the local host to submit crafted input that the service passes into a command execution context without sufficient sanitization. Because the exelban stats helper runs with elevated privileges, injected commands execute in that same security context.

Root Cause

The root cause is improper neutralization of special elements in an output used by a downstream component [CWE-74]. The shouldAcceptNewConnection handler does not adequately validate the connecting client or sanitize parameters passed through the XPC interface. Attacker-controlled content flows into a command invocation, permitting shell metacharacters or arguments to alter the intended command.

Attack Vector

Exploitation requires local access with low privileges on the target macOS system. An attacker connects to the exposed XPC endpoint and delivers a crafted payload that abuses the missing validation in shouldAcceptNewConnection. No user interaction is required. The result is arbitrary command execution in the context of the privileged helper, effectively escalating the attacker's rights on the host.

No public proof-of-concept code has been released. Technical write-up details are available in the Winslow CVE Collection and the VulDB entry.

Detection Methods for CVE-2025-0396

Indicators of Compromise

Unexpected child processes spawned by the exelban stats helper binary or its XPC service
Shell interpreter invocations (/bin/sh, /bin/bash, /bin/zsh) originating from the stats helper process tree
Modifications to LaunchDaemons or system paths shortly after XPC connections to the stats service
New privileged files or persistence entries created by a process parented under the stats helper

Detection Strategies

Monitor macOS Endpoint Security events (ES_EVENT_TYPE_NOTIFY_EXEC) where the parent process is the exelban stats helper
Baseline the normal child-process set of the stats helper and alert on deviations
Inspect Unified Logs for XPC connection events referencing the exelban stats service with unusual arguments
Correlate installed stats versions with those below 2.11.22 across the fleet using software inventory data

Monitoring Recommendations

Enable process-lineage telemetry on macOS endpoints and forward it to a centralized analytics platform
Track file integrity for the stats application bundle and its embedded XPC helper
Alert on privilege-escalation patterns such as a low-privilege user process triggering a high-privilege child

How to Mitigate CVE-2025-0396

Immediate Actions Required

Upgrade exelban stats to version 2.11.22 or later on all macOS endpoints
Inventory macOS hosts for vulnerable stats versions and prioritize systems with multi-user or shared access
Review recent XPC service activity for signs of exploitation before patching
Revoke and reissue any credentials stored on hosts that show suspicious helper-process activity

Patch Information

The maintainer released the fix in the exelban/stats v2.11.22 release. This build corrects the validation logic in the XPC Service's shouldAcceptNewConnection implementation. Administrators should deploy the update through their standard macOS software distribution workflow.

Workarounds

Uninstall exelban stats on hosts where an immediate upgrade to 2.11.22 is not feasible
Restrict local, interactive access to affected macOS systems until the patch is applied
Remove the stats LaunchDaemon plist to disable the privileged helper on unpatched systems

bash

# Verify the installed exelban stats version and remove vulnerable builds
/Applications/Stats.app/Contents/MacOS/Stats --version
sudo launchctl unload /Library/LaunchDaemons/eu.exelban.Stats.SMC.Helper.plist
sudo rm -rf /Applications/Stats.app
# Then install v2.11.22 or later from the official GitHub release