BuhoCleaner 1.15.2 contains a TOCTOU race condition (CWE-367) in an insecure XPC service that enables local unprivileged users to escalate privileges to root. The vulnerability arises from insecure functions within the service that do not properly handle timing between security checks and resource use, allowing an attacker to exploit this window to gain elevated privileges. The CVSS 4.0 vector indicates local attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local unprivileged user to escalate privileges to root, potentially leading to full system compromise. This elevates the risk of unauthorized access to sensitive data, system modification, or disruption of service on affected systems running BuhoCleaner 1.15.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and consider disabling or limiting use of the vulnerable XPC service if possible.