CVE-2025-54595: Arbitrary Code Execution in PearcleanerHelper

The PearcleanerHelper, designed to perform privileged cleaning operations on macOS, registers an XPC service accessible to any local process without authentication. This service exposes a method that directly executes shell commands. An attacker who can interact with the local system can leverage this vulnerability to gain root access, install malware, modify system files, or exfiltrate sensitive data. Given the helper's root privileges, the blast radius of a successful exploitation is the entire macOS system. This vulnerability shares similarities with other XPC service vulnerabilities where improper access controls lead to privilege escalation.

1. Reserved2025-07-25
2. Published2025-08-01
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-54595 is to immediately upgrade Pearcleaner to version 4.5.2 or later. If upgrading is not immediately feasible, consider isolating PearcleanerHelper processes to prevent unauthorized access. While a direct workaround is not available, restricting network access to the XPC service (com.alienator88.Pearcleaner.PearcleanerHelper) could limit the attack surface. Monitor system logs for suspicious process activity related to PearcleanerHelper and implement strict access controls on the system to limit the potential impact of a successful exploit.