CVE-2025-4960: high flaw in EPSON InstallNavi

EPSON macOS helper tool exposes privileged operations to local users without admin credentials.

CVE-2025-4960 concerns the com.epson.InstallNavi.helper component, distributed with the EPSON printer driver installer on macOS. According to the official NVD description, the tool fails to properly authenticate clients communicating over the XPC protocol and does not correctly enforce macOS's authorization model, exposing privileged functionality to unauthorized users.

The issue stems from the use of the AuthorizationCopyRights API with overly permissive custom rights registered in the system's authorization database. These rights can be granted by the authorization daemon to any local user, allowing arbitrary commands or system installations without admin credentials. The declared CVSS score is 7.8, high range. A public repository has also been reported claiming to contain material related to this flaw: a signal of interest, not confirmation of active exploitation.

Organizations using EPSON printers with this installer on macOS endpoints should check for the affected component and promptly apply any vendor updates, if available. Absent official information on fixed versions, monitor EPSON communications, restrict local account permissions, and review logs for anomalous activity indicative of privilege escalation.

At a glance

What: The com.epson.InstallNavi.helper component, bundled with the EPSON printer driver installer, fails to properly authenticate clients over XPC and does not correctly enforce macOS's authorization model.
Severity: CVSS 7.8 (high range).
Affected versions: Not reported in the official data.
Fix: Not reported in the official data; administrators should check for updates provided by EPSON for the affected driver.
Status: Published on NVD on 2026-02-19; a public repository has been reported claiming to contain related material, an unverified signal regarding exploitation.
Action: Check macOS enterprise systems for this component, apply any vendor updates, and limit unnecessary local user accounts.

Sources: NVD, CVE-2025-4960

← All articles