Vulnerability · Published Sep 24, 2025 · Assigned by VulDB

CVE-2025-10906Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication

High 8.4

In plain English

A high-severity missing authentication in Endurance from Magnetism Studios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authentication. The attack needs to be launched locally. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
Magnetism Studios	Endurance	3.03.13.23.3.0

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-325691 | Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication vdb-entry, technical-description
VDB-325691 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #653994 | Magnetism Studios Endurance 3.3.0 Local Privilege Escalation third-party-advisory
https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md related
https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md#proof-of-concept exploit