CVE-2026-49237: Multipass macOS Privilege Escalation via Unprotected Auxiliary Binaries

Technical summary

CVE-2026-49237 stems from incomplete remediation of CVE-2025-5199 in Multipass prior to version 1.16.3. While the earlier patch changed multipassd ownership to root:wheel, five auxiliary binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ remain owned by the installing user and world-writable. The root LaunchDaemon (com.canonical.multipassd.plist) configures PATH to prioritize this user-controlled directory and invokes these binaries by bare name rather than full path. An unprivileged local user can therefore perform a binary hijacking attack: replace a utility binary with a wrapper, wait for daemon invocation (triggered during operations like 'multipass launch'), and gain code execution as root.

Business impact

Multipass users on affected macOS systems face local privilege escalation risk. Any user with shell access to the machine can escalate to root, enabling complete system compromise, data theft, malware installation, and lateral movement. Organizations deploying Multipass for development, testing, or VM management should treat this as a critical local security boundary violation. The vulnerability does not require network access or user interaction—only local machine access.

Affected systems

Canonical Multipass for macOS versions before 1.16.3 are affected. The vulnerability is platform-specific to macOS due to LaunchDaemon PATH configuration. macOS systems with Multipass installed via the official installer are at risk. Verify your installed version via 'multipass version' command. Users running version 1.16.3 or later are not affected.

Exploitability

Exploitability is straightforward for local attackers. The attack requires no special privileges beyond local login or shell access, no user interaction, and minimal complexity—replacing a file in a known, predictable location. The PATH hijacking is deterministic; any auxiliary binary invocation by the daemon triggers the malicious code. No authentication bypass or race conditions are needed. This is classified as HIGH severity (CVSS 7.8) with low attack complexity due to the direct path from local access to root code execution.

Remediation

Update Canonical Multipass to version 1.16.3 or later as soon as possible. This version corrects the ownership and permissions of all auxiliary binaries to prevent user modification. Administrators should verify the fix by confirming that all binaries in /Library/Application Support/com.canonical.multipass/bin/ are owned by root and non-writable by unprivileged users post-upgrade.

Patch guidance

Download and install Multipass 1.16.3 or later from Canonical's official repository or website. On macOS, uninstall the current version and perform a fresh installation, or use the auto-update mechanism if enabled. After upgrade, verify ownership and permissions: 'ls -la /Library/Application\ Support/com.canonical.multipass/bin/' should show root ownership and restrictive permissions (e.g., 0755). Test core Multipass operations (launch, stop, delete instances) to confirm functionality post-patch.

Detection guidance

Monitor file system changes in /Library/Application Support/com.canonical.multipass/bin/ for unauthorized modifications or permission changes to auxiliary binaries. Alert on any user-initiated writes to this directory. Check current file ownership and permissions against the expected root:wheel ownership with restricted write access. Audit running processes to detect binaries in this directory executing with unexpected parent processes or user contexts. Query system logs for unusual multipassd or auxiliary binary invocations.

Why prioritize this

This vulnerability merits immediate priority despite no KEV listing. The incomplete prior fix demonstrates supply chain execution complexity; users who patched for CVE-2025-5199 may believe themselves protected but remain exposed. The attack surface is trivial for any local user, and the impact is root compromise. Development and testing teams relying on Multipass should treat this as critical. The ease of exploitation and severity of impact justify rapid patching.

Risk score, explained

CVSS 7.8 (HIGH) reflects local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of local privilege escalation to root on a development tool. Organizations with strict local access controls may see reduced real-world risk, but the theoretical exploitability remains high for any system where local users have shell access.

Frequently asked questions