Skip to content
Fencer Vulns
medium 6.9

CVE-2007-0023 json

The CFUserNotificationSendRequest function in UserNotificationCenter.app in Apple Mac OS X 10.4.8, when used in combination with diskutil,…

published 2007-01-24 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0027

cvss
6.9
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
1
Exploit-DB

Summary

The CFUserNotificationSendRequest function in UserNotificationCenter.app in Apple Mac OS X 10.4.8, when used in combination with diskutil, allows local users to gain privileges via a malicious InputManager in Library/InputManagers in a user's home directory, which is executed when Cocoa applications attempt to notify the user.

Timeline

  1. First public exploit (EDB-3181)
  2. Published

Exploit prediction

1.63% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-3181 Apple Mac OSX 10.4.8 - 'UserNotificationCenter' Local Privilege Escalation local, 2007-01-23
  • projects.info-pull.com http://projects.info-pull.com/moab/MOAB-22-01-2007.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.