macOS TimeMachine XPC flaws enabled root LPE

2 August 2026 elevated vulnerability

Two macOS local privilege escalation bugs (CVE-2019-8513, CVE-2019-8530) in TimeMachine diagnostic helpers allowed reliable root access; patched in 10.14.4.

Researchers detailed two local privilege escalation vulnerabilities affecting macOS 10.12.x through 10.14.3, both residing in Apple's TimeMachine diagnostic XPC helpers. CVE-2019-8530 is an arbitrary file write issue in the timemachinehelper XPC service, which fails to validate the destination directory before writing diagnostic logs, previously combinable with a since-patched sudo timestamp flaw to escalate privileges. CVE-2019-8513 is a command injection vulnerability in the tmdiagnose binary, where output from `diskutil list` is piped into an awk/system() call; by crafting a malicious disk image volume label containing CRLF and shell metacharacters, an attacker could inject arbitrary shell commands executed as root.

Mentioned in this report

Vulnerabilities CVE-2019-8513weaponizedCVE-2019-8530

Detection guidance

tmdiagnose Command Injection via Crafted Disk Volume Label

ATT&CK T1059.004

tmdiagnose binary executing shell commands with metacharacters/CRLF injected through disk volume labels processed by diskutil and awk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: tmdiagnose Command Injection via Crafted Disk Volume Label
description: Detects tmdiagnose binary spawning shell commands (sh/bash) with arguments
  containing shell metacharacters or CRLF sequences, indicative of command injection
  through malicious disk volume labels processed by diskutil piped to awk/system().
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /tmdiagnose
    Image|endswith:
    - /sh
    - /bash
    CommandLine|contains:
    - $(\x0a
    - '`\x0a'
    - '|\x0a'
    - ;\x0a
    - '&&\x0a'
    - '||\x0a'
  filter_legitimate_tmdiagnose:
    CommandLine|contains:
    - /bin/sh -c /usr
    - /bin/bash -c /usr
  condition: selection and not filter_legitimate_tmdiagnose
falsepositives:
- Legitimate tmdiagnose diagnostic collection with intentional shell piping
- macOS system diagnostics tools performing multi-stage command processing
level: high
id: 7170b440-281d-5669-b92b-a0c69902e709
status: experimental
author: Vorant

TimeMachineHelper Arbitrary File Write to System Directories

ATT&CK T1574

timemachinehelper XPC service writing files to sensitive system directories without proper path validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: TimeMachineHelper Arbitrary File Write to System Directories
description: Detects timemachinehelper XPC process writing files to system-owned directories
  (/etc, /System, /Library/LaunchDaemons, /Library/LaunchAgents, /var/root) without
  validation, typical of arbitrary file write exploitation in CVE-2019-8530.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t1574
logsource:
  category: file_event
  product: macos
detection:
  selection:
    Image|endswith: /timemachinehelper
    TargetFilename|startswith:
    - /etc/
    - /System/
    - /Library/LaunchDaemons/
    - /Library/LaunchAgents/
    - /var/root/
    EventType: WriteFile
  filter_legitimate_launchd:
    TargetFilename|contains: com.apple.timemachine
  condition: selection and not filter_legitimate_launchd
falsepositives:
- Legitimate macOS system updates modifying LaunchDaemon plists for Time Machine
- Apple administrative tools provisioning Time Machine configuration files
level: high
id: 3ff3a1cd-89bb-5fda-bd7c-a61f8358dca5
status: experimental
author: Vorant

TimeMachineHelper XPC Service Spawning Privileged Shell

ATT&CK T1068

timemachinehelper XPC daemon spawning shell interpreters to execute diagnostic or system commands, potential privilege escalation vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: TimeMachineHelper XPC Service Spawning Privileged Shell
description: Detects timemachinehelper XPC process spawning sh/bash, indicative of
  command execution leveraging the XPC service's elevated privileges for privilege
  escalation.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /timemachinehelper
    Image|endswith:
    - /sh
    - /bash
  filter_legitimate_diagnostics:
    CommandLine|contains:
    - /bin/sh -c /usr/bin/log
    - /bin/sh -c diskutil
    - /bin/sh -c /Library/Application Support/
  condition: selection and not filter_legitimate_diagnostics
falsepositives:
- Legitimate Time Machine diagnostic collection invoking shell helpers
- macOS system maintenance tasks using timemachinehelper for subprocess execution
level: medium
id: f1c6f1dc-6d51-5f5e-bdc2-3b72aaded5b2
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x40.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free