Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
References
| Link | Resource |
|---|---|
| https://m8sec.dev/blog/privilege-escalation-macos-pkg-installers/ | Exploit Third Party Advisory |
| https://www.anaconda.com/docs/getting-started/miniconda/release/23.x#miniconda-23-11-0-1 | Release Notes |
Configurations
Configuration 1 (hide)
| AND |
|
History
05 Jan 2026, 14:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* cpe:2.3:a:conda:miniconda3:*:*:*:*:*:*:*:* |
|
| First Time |
Conda
Apple Conda miniconda3 Apple macos |
|
| References | () https://m8sec.dev/blog/privilege-escalation-macos-pkg-installers/ - Exploit, Third Party Advisory | |
| References | () https://www.anaconda.com/docs/getting-started/miniconda/release/23.x#miniconda-23-11-0-1 - Release Notes |
18 Dec 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-77 CWE-732 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
17 Dec 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-17 19:16
Updated : 2026-01-05 14:37
NVD link : CVE-2024-46062
Mitre link : CVE-2024-46062
CVE.ORG link : CVE-2024-46062
JSON object : View
Products Affected
conda
- miniconda3
apple
- macos