CVE-2025-2098: Fast CAD Reader Privilege Escalation

CVE-2025-2098 Overview

CVE-2025-2098 affects the Fast CAD Reader application on macOS. The application installs with world-writable file permissions (rwxrwxrwx) instead of the standard macOS drwxr-xr-x. This misconfiguration enables Dylib Hijacking, allowing local attackers to replace application binaries or dynamic libraries with malicious versions. Guest accounts, standard users, and other applications can leverage this weakness for privilege escalation and code execution in the context of privileged users. The issue was confirmed in version 4.1.5 and likely affects all released versions, as the vendor has not responded to disclosure attempts. The vulnerability is tracked under [CWE-732] (Incorrect Permission Assignment for Critical Resource).

Critical Impact
Any local user, including the guest account, can replace application files to execute arbitrary code as any user who launches Fast CAD Reader.

Affected Products

Fast CAD Reader for macOS version 4.1.5
Fast CAD Reader for macOS (all prior versions, unconfirmed)
Distributed via the Apple App Store

Discovery Timeline

2025-03-26 - CVE-2025-2098 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2098

Vulnerability Analysis

The vulnerability stems from insecure file permissions applied to the Fast CAD Reader application bundle during installation. macOS applications typically install under /Applications with directory permissions of drwxr-xr-x, restricting write access to the root user or the installing administrator. Fast CAD Reader instead sets rwxrwxrwx (mode 0777) on its bundle contents.

This permission mask grants read, write, and execute rights to every local principal on the system, including the guest account. Any user can overwrite the main executable, embedded frameworks, or dynamic libraries (.dylib files) inside the application bundle. When another user, particularly an administrator, subsequently launches Fast CAD Reader, macOS loads the attacker-controlled libraries under that user's security context.

Because the application is signed and distributed through the App Store, victims have no visual indication that a Dylib Hijacking attack has occurred. The technical write-up is available in the CERT PL advisory.

Root Cause

The root cause is an installer configuration error that fails to apply restrictive permissions to the application bundle. The chmod 0777 equivalent state persists after installation, violating Apple's guidance that application resources be owned by root:wheel with world-readable but not world-writable permissions. This maps to [CWE-732], Incorrect Permission Assignment for Critical Resource.

Attack Vector

An attacker with local access, including an unprivileged guest, identifies a writable dylib or executable within /Applications/Fast CAD Reader.app/. The attacker replaces the target file with a malicious payload that preserves the expected export symbols. When a higher-privileged user launches the application, the dynamic linker loads the attacker-supplied library, executing arbitrary code in the victim's session. No user interaction beyond launching the application is required. See the CERT PL advisory for exploitation specifics.

Detection Methods for CVE-2025-2098

Indicators of Compromise

Files within /Applications/Fast CAD Reader.app/ with modification timestamps that differ from the original installation date
Presence of unsigned or ad-hoc signed .dylib files inside the Fast CAD Reader bundle
Unexpected child processes spawned by Fast CAD Reader such as shells, curl, or osascript
Outbound network connections originating from the Fast CAD Reader process to non-vendor domains

Detection Strategies

Audit permissions on all installed macOS applications using ls -lde /Applications/*.app and flag bundles with world-writable modes
Monitor file integrity of application bundles with tools such as codesign --verify --deep --strict to detect tampering with signed binaries
Alert on dynamic library loads from writable paths by processes signed with the Fast CAD Reader team identifier

Monitoring Recommendations

Enable macOS Endpoint Security Framework telemetry for ES_EVENT_TYPE_NOTIFY_EXEC and ES_EVENT_TYPE_NOTIFY_MMAP events targeting /Applications/Fast CAD Reader.app/
Log write operations to application bundles from non-administrative users through EDR file-modification events
Track process lineage where Fast CAD Reader is the parent to detect post-exploitation activity

How to Mitigate CVE-2025-2098

Immediate Actions Required

Manually correct permissions on the installed application bundle using sudo chmod -R 755 "/Applications/Fast CAD Reader.app" and sudo chown -R root:wheel "/Applications/Fast CAD Reader.app"
Uninstall Fast CAD Reader on multi-user macOS systems where guest or standard users cannot be trusted
Disable the guest account on affected macOS endpoints to reduce the pool of potential local attackers

Patch Information

No vendor patch is available. The CERT PL advisory notes that the vendor did not respond to disclosure attempts, so all versions including 4.1.5 remain affected. Refer to the CERT PL CVE-2025-2098 post for the most current status.

Workarounds

Restrict installation of Fast CAD Reader to single-user workstations where local privilege escalation risk is limited
Apply macOS configuration profiles that prevent standard users from executing the application
Deploy application allowlisting to block modified copies of the Fast CAD Reader binaries and dylibs from executing

bash

# Configuration example: correct permissions and ownership on the bundle
sudo chown -R root:wheel "/Applications/Fast CAD Reader.app"
sudo chmod -R 755 "/Applications/Fast CAD Reader.app"

# Verify the resulting permissions
ls -lde "/Applications/Fast CAD Reader.app"
codesign --verify --deep --strict "/Applications/Fast CAD Reader.app"