CVE-2026-19755

CVE-2026-19755 describes a vulnerability in NoSleep, a third-party menu bar utility that prevents MacBooks from sleeping when the lid is closed. The issue is an unprotected Mach service that accepts raw dictionary messages over XPC — bypassing the compile-time type enforcement that protocol-based XPC interfaces normally provide. This is a known pattern in macOS third-party development, but it creates a real attack surface when the service runs as a persistent login item with an open IPC endpoint. The practical risk depends on three factors you should investigate immediately. First, does NoSleep enforce any authorization check or process identity validation on incoming XPC connections? An unprotected Mach service accepts connections from any process in the user session, making it a viable sandbox escape vector for malicious code already running on the system. Second, what entitlements does NoSleep actually hold? Check for com.apple.security.temporary-exception.mach-lookup or any hardened runtime exceptions that would amplify access beyond standard user-level privileges. Third, what operation does the 'command' parameter trigger? If it performs file system access, process execution, or interacts with any privileged subsystem, the attack surface expands significantly. The CVSS 6.9 score likely underweights the persistence factor. NoSleep runs as a login item from session start and maintains an active Mach service throughout — unlike a one-shot vulnerability, this is a permanently available pivot point. However, menu bar utilities typically run with standard user privileges, not elevated entitlements, which limits the escalation path to lateral movement within the user session rather than direct root or kernel access. Remediation is complicated by NoSleep's update mechanism. Third-party menu bar utilities rarely ship through AutoUpdate or background agents; the typical path requires manual user intervention. This means the exposure window may extend for months rather than weeks. If you're managing Mac endpoints, treat this as a higher priority than the EPSS score suggests simply because unpatched instances will persist longer in the fleet than typical system vulnerabilities.

Reviewed through automated stages and approved by a human before publication.