Apple Screen Sharing Vulnerability Exploited to Execute Command as Root

A newly disclosed logic flaw in macOS Screen Sharing shows how a feature meant only to grant screen-viewing access can be twisted into a path for full root command execution.

The issue, tracked as CVE-2026-43760, affects the screensharingd service and its file-copy helpers, SSFileCopySender and SSFileCopyReceiver, on macOS systems where Screen Sharing or Remote Management is enabled with the legacy VNC password option turned on.

The root cause lies in how Apple’s Screen Sharing service handles two very different authentication paths. When a user connects through native Apple authentication, the service correctly identifies them as a macOS account and runs any file-copy operations under that user’s own permissions.

Apple Screen Sharing Vulnerability

But when someone connects through the older VNC authentication method, using only the separately configured “VNC viewers may control screen with password” credential, there is no macOS user identity behind that password. Instead of scaling back privileges accordingly, the file-copy helpers kept running as root.

That feature created two connected vulnerabilities. On the read side, a remote viewer could ask SSFileCopySender to fetch any file path of their choosing, and because the helper ran as root, it happily returned the contents of protected files such as /etc/sudoers, files an ordinary user account could never read directly.

On the write side, SSFileCopyReceiver let a remote viewer specify a destination directory, filename, permissions, and file contents, again executed with root authority.

Bynar researchers used this to write a new file directly into /private/etc/sudoers.d, a directory where any properly formatted, correctly permissioned file is automatically trusted by the sudo command.

By crafting a valid root-owned sudoers policy through this remote file-write primitive, the researchers granted a non-admin account passwordless sudo access.

From there, a single command opened an interactive root shell, fully remote, achieved entirely through the authenticated Screen Sharing session and its file-copy protocol, with no memory corruption, buffer overflow, or exploit chain involved.

Apple has described the flaw simply as allowing an app to access sensitive user data, but researchers argue this significantly understates its real impact, since the bug also enables arbitrary root file creation and remote command execution.

Independent analysis assigns it a CVSS 3.1 score as high as 8.8 in scenarios where an unlocked session is already active, compared to Apple’s official 5.5 rating.

Apple patched the issue in macOS Tahoe 26.6 and macOS Sonoma 14.8.8, both released July 27, 2026. Users who cannot update immediately should disable the “VNC viewers may control screen with password” option, or turn off Screen Sharing and Remote Management entirely if remote access isn’t required. Simply changing the VNC password does not fix the underlying authorization flaw.

The case underscores a broader trend in vulnerability research: as memory-safety protections like Memory Integrity Enforcement and Pointer Authentication make traditional exploitation harder, attackers and researchers alike are turning toward logic and authorization bugs, flaws where every individual operation behaves as designed, but the wrong entity ends up in control.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.