Sparkle-Project Sparkle
5 CVEs affecting Sparkle-Project Sparkle. Latest disclosed: 2026-07-21. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0509 | High | 7.3 | 2025-02-04 | A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA… |
CVE-2026-47121 | Medium | 6.1 | 2026-07-21 | Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObjec… |
CVE-2026-47122 | Medium | 4.2 | 2026-07-21 | Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforc… |
CVE-2025-10016 | | 2025-09-16 | The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request install… | |
CVE-2025-10015 | | 2025-09-16 | The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged atta… |