Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-5963: Postbox on macOS can be exploited by malicious code injection

CVE-2025-5963 · published 1 year ago

Summary

A known security weakness in Postbox on macOS makes it possible for a hacker with some computer access to add malicious code to the app, potentially gaining access to system resources. Since the company behind Postbox is no longer supporting the software, no fixes will be made. Users should consider replacing Postbox with a different email client.

Original advisory text

The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

The original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-276Incorrect Default Permissions

Timeline

Published20 Jun 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-5963 · NVD

Track software like this

Free during beta