PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4617 Apple CVE debrief

CVE-2016-4617 is a local macOS sandbox escape issue in Apple’s libxpc component. According to NVD, it affects macOS versions up to 10.11.6 and is associated with launchctl process spawning. The vulnerability is rated 8.8 HIGH, with low attack complexity, low privileges required, no user interaction, and a changed scope impact profile.

Vendor
Apple
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Mac administrators, endpoint security teams, and users running macOS 10.11.6 or earlier should care most. The issue is local and affects system containment boundaries, so it matters for fleets that still include legacy Apple systems or any environment where untrusted code can run on affected hosts.

Technical summary

NVD describes the flaw as a sandbox escape in Apple’s libxpc component related to launchctl process spawning. The vulnerability applies to macOS versions through 10.11.6, with Apple’s advisory referenced by NVD. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates a local attack that can cross security boundaries and potentially lead to high impact on confidentiality, integrity, and availability.

Defensive priority

High for any environment that still runs macOS 10.11.6 or earlier. Because the issue can break sandbox boundaries and has high CIA impact, affected legacy Macs should be prioritized for upgrade or removal from service.

Recommended defensive actions

  • Inventory all Macs and identify systems running macOS 10.11.6 or earlier.
  • Upgrade affected hosts to macOS 10.12 or later using Apple’s vendor guidance.
  • Restrict local code execution opportunities on legacy systems until they are updated or retired.
  • Review endpoint telemetry for unusual sandbox escapes or unexpected launchctl-related activity on affected hosts.
  • Treat any unpatched legacy macOS system as high risk and isolate it from sensitive workloads where possible.

Evidence notes

Evidence is limited to the NVD record and the Apple advisory reference surfaced there. NVD states the affected range as macOS through 10.11.6 and lists the vulnerability as a sandbox escape in libxpc involving launchctl process spawning. NVD also provides the CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and references Apple support article HT207170 as the vendor advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-4617 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-4617

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-4617 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4617

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.