Critical Vulnerabilities in Microsoft macOS Apps Expose Users to Potential Unauthorized Access

Eight newly discovered vulnerabilities in Microsoft applications for macOS could enable attackers to bypass the operating system’s permissions framework, allowing unauthorized access to sensitive data and elevated privileges. The vulnerabilities affect popular Microsoft apps, including Outlook, Teams, Word, Excel, PowerPoint, and OneNote. Security researchers from Cisco Talos warn that these flaws could let attackers send emails, record audio or video, and take photos without the user’s consent.

Understanding the TCC Framework
Apple’s Transparency, Consent, and Control (TCC) framework is designed to protect sensitive user data on macOS by ensuring that applications only access data with explicit user consent. TCC works alongside macOS’s application sandboxing feature, which restricts an app’s access to the system and other applications, providing an extra layer of security. The framework maintains an encrypted database that records the permissions granted by users to each application, ensuring consistent enforcement across the system. This approach aims to provide transparency and control over how applications interact with user data.

However, Cisco Talos has highlighted that these protections can be circumvented if an attacker can inject malicious code into trusted applications. This type of attack, known as library injection or Dylib Hijacking, allows malicious libraries to be loaded into the application, which then operates with the permissions and entitlements granted to the legitimate app.

How the Vulnerabilities Work
The vulnerabilities identified in Microsoft’s macOS applications could allow an attacker to inject malicious libraries into these apps, thereby gaining access to sensitive information and privileges granted to the applications. For instance, an attacker could exploit these flaws to send emails from the user’s account, record audio clips, or take pictures and videos—all without the user’s knowledge or consent.

According to Talos researcher Francesco Benvenuto, macOS includes countermeasures such as the hardened runtime feature, which is designed to minimize the risk of executing arbitrary code within another app’s process. However, if an attacker manages to inject a library into the process space of a running application, they can misuse all the permissions already granted to that app, effectively operating as if they were the application itself.

Potential Risks and Exploitation Scenarios
While the vulnerabilities pose significant risks, exploiting them requires attackers to have some level of access to the compromised system beforehand. This access can be used to inject a malicious library into a more privileged app, granting the attacker permissions associated with the exploited application. A trusted app compromised in this manner could then be used to abuse its permissions, giving the attacker unauthorized access to sensitive data without user consent.

These vulnerabilities often exploit scenarios where applications load libraries from locations that an attacker could manipulate, especially if the application has disabled library validation—a risky entitlement that, when set to true, allows loading of libraries not signed by the application’s developer or Apple.