Fixed by the vendor. Published after the coordinated-disclosure window elapsed.
FMSSP-2026-0001Bitfocus Companion for macOS through 4.2.6 ships a hardened-runtime code signature that includes both com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation. Together these two entitlements re-enable DYLD_INSERT_LIBRARIES loading of arbitrary unsigned dynamic libraries into the signed, notarized application process.
Code injected this way runs under Companion's code-signing identity (Team ID FGQ2G3HYBT), inherits its entitlements, and — the substantive impact — inherits TCC permissions the user granted to Companion. This was demonstrated for Accessibility: injected code reads window titles, focused UI element contents, and the running-application list across the entire desktop, which an equivalent unprivileged process cannot do.
Fixed in 4.3.0 (released 2026-04-19) by removing the DYLD environment-variable entitlement.
| Product | Bitfocus Companion for macOS |
|---|---|
| Vendor | Bitfocus AS |
| Bundle ID | test-companion.bitfocus.no |
| Team ID | FGQ2G3HYBT |
| Affected | ≤ 4.2.6 (verified on 4.2.5) |
| Fixed | 4.3.0 |
| Platform | macOS (hardened runtime, Developer ID signed, notarized) |
CVSS v3.1 6.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Scope is Changed because the attacker's own process cannot access Accessibility, while code injected into Companion can — a TCC boundary is crossed. Integrity is scored None: write-side Accessibility actions (keystroke injection, UI control) are enabled by the inherited grant but were deliberately not demonstrated, and are not claimed here.
CWE-426 Untrusted Search Path · CWE-94 Improper Control of Generation of Code
Under the macOS hardened runtime, DYLD_* environment variables are stripped and Library Validation requires any loaded dylib to be signed by the same Team ID. Two entitlements undo this:
com.apple.security.cs.allow-dyld-environment-variables — restores DYLD_* passthroughcom.apple.security.cs.disable-library-validation — removes the Team-ID signing requirementNeither alone is sufficient. disable-library-validation without the DYLD entitlement leaves the environment variable ignored; the DYLD entitlement without library validation disabled still requires a validly-signed dylib. Companion ≤ 4.2.6 shipped both, restoring classic DYLD_INSERT_LIBRARIES injection against a signed, notarized application.
Companion's 4.2.5 signature also carried com.apple.security.cs.allow-jit, com.apple.security.cs.allow-unsigned-executable-memory, com.apple.security.cs.debugger, com.apple.security.automation.apple-events, and network client/server entitlements, all of which are inherited by injected code.
An attacker sets the environment variable before launching the application:
DYLD_INSERT_LIBRARIES=/tmp/inject.dylib /Applications/Companion.app/Contents/MacOS/CompanionThe injected dylib's constructor executes inside the Companion process. Verified from injected code:
SecCodeCopySelf reports Team ID FGQ2G3HYBTAXIsProcessTrusted() returns YESAXTextArea)This is what establishes the boundary. The identical Accessibility operations were run from a standalone binary launched by a LaunchAgent — same user, no Terminal ancestry, no injection.
| Operation | Injected into Companion | Standalone LaunchAgent binary |
|---|---|---|
AXIsProcessTrusted | YES | NO |
| Enumerate windows | 10 apps, 11 windows | BLOCKED (AXError -25204) |
| Read focused element | AXTextArea | BLOCKED (AXError -25204) |
Both harnesses were launched via LaunchAgent specifically so that neither could inherit Terminal's own TCC grants. The capability exists only inside Companion's process — that is the boundary crossing.
Tested on macOS 26.4 (Tahoe), build 25E246, SIP enabled, Companion 4.2.5 with Accessibility granted.
Remove from the production entitlements file:
com.apple.security.cs.allow-dyld-environment-variablescom.apple.security.cs.disable-library-validationRemoving the first alone closes this attack path. If either is required for development or plugin work, use a separate development-signed build that is not distributed to users. No application code change is required.
The vendor has done this. launcher/entitlements.mac.plist in commit cd78cf5801d2 (“fix: try removing unnecessary entitlements”, 2026-03-29) removed both allow-dyld-environment-variables and cs.debugger. That change shipped in 4.3.0 on 2026-04-19. disable-library-validation remains in current builds but is not independently exploitable via this path, since the DYLD environment variables are no longer honored.
Anyone running Companion 4.2.6 or earlier on macOS should update to 4.3.0 or later.
Verify your own build:
codesign -d --entitlements :- --xml /Applications/Companion.app 2>/dev/null \
| grep -c 'allow-dyld-environment-variables' # 0 = not affected[email protected]); 90-day deadline stated as 2026-07-03cd78cf5801d2 authored — predates this report[email protected] — undeliverable, address does not existWe claim no credit for the remediation
The vendor's fix commit predates this report by six days. Fortress MSSP makes no claim to have caused the remediation. This advisory is published to document a CVE that was assigned to a genuine, demonstrated issue in shipped versions, so that operators still running ≤ 4.2.6 can identify and resolve their exposure.
There is no suggestion of vendor negligence: the issue was already fixed in their development branch when reported, and a fixed release has been publicly available since 2026-04-19.
Mustafa Ahmed, Fortress MSSP LLC — fortressmssp.com
A verbatim Markdown copy of this advisory is available for archival, mirroring, and machine consumption.
CVE-2026-39225.txtFortress MSSP publishes advisories for vulnerabilities our research finds in third-party software, after coordinated disclosure.
Fortress MSSP LLC is not a CVE Numbering Authority. CVE-2026-39225 was assigned by MITRE (CNA-LR) in response to our coordinated-disclosure report. We do not assign, reserve, or issue CVE IDs. To report a vulnerability in a Fortress MSSP system, see our responsible disclosure policy.