CVE-2019-12577

CVE-2019-12577 is a local privilege escalation vulnerability affecting the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. An authenticated, local attacker can exploit a flaw in how the setuid root openvpn_launcher.64 binary creates temporary files, specifically /tmp/pia_upscript.sh, due to an inherited umask value. This allows the attacker to manipulate file permissions and inject arbitrary code into the script. The vulnerability has a CVSS v3.0 score of 7.8 (High), indicating a high potential impact on confidentiality, integrity, and availability. The attack requires local access and low privileges but has low attack complexity. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE. It is not listed in CISA's Known Exploited Vulnerabilities Catalog.