Information Disclosure in iTerm2 for macOS

Executive Summary

CVE-2026-88514 is a security flaw in iTerm2 for macOS before version 3.6.12. It allows a local attacker to exploit a predictable socket file in a shared directory to perform a man-in-the-middle attack. The attacker could pre-create a socket file named iTerm2.socket.<pid> in /var/tmp, inject a malicious pseudo-terminal, and intercept sensitive data like keystrokes and credentials.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious socket files in /var/tmp named iTerm2.socket.<pid> owned by unexpected users. Use commands like 'ls -la /var/tmp/iTerm2.socket.*' to inspect socket files and 'ps aux | grep iTerm2' to verify legitimate processes. Monitor for unauthorized pseudo-terminal (pty) usage or unexpected data interception.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a local attacker to intercept sensitive information such as keystrokes, credentials, and other data entered in iTerm2. If exploited, it may lead to unauthorized access to confidential information or account takeover.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to intercept sensitive data like keystrokes and credentials via a man-in-the-middle attack. This could lead to unauthorized access to personal or health information, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update iTerm2 to version 3.6.12 or later immediately. Remove any suspicious socket files in /var/tmp. Avoid using shared directories for sensitive operations. Restrict write permissions to /var/tmp if possible.

Useful 0 Not Useful 0