Intego Log Reporter contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability (CWE-367) in a root-executed diagnostic script that writes files to /tmp insecurely. This allows a local unprivileged user to exploit a symlink race condition to overwrite arbitrary files in privileged system locations, resulting in local privilege escalation to root. The vulnerability affects the version identified as '0' and is specific to macOS environments where Intego Log Reporter is installed. The CVSS 4.0 vector indicates low attack complexity but requires local access and no user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local unprivileged user to escalate privileges to root by exploiting a race condition in file handling within Intego Log Reporter. This compromises system integrity and security by enabling arbitrary file writes to privileged locations. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to systems running Intego Log Reporter and monitor for suspicious activity related to /tmp file operations. Avoid running diagnostic scripts with root privileges where possible.