Permission abuse via missing hardened runtime

Permission bypass in Apple iMovie before 10.2.4 allows local users to use its entitlements and privacy permissions through a malicious app. The iMovie executable lacks the hardened runtime, allowing another application to exploit privileges and privacy access already granted to iMovie. Execution of a malicious local application and user interaction are required; the consequence is limited to resources covered by iMovie's existing grants.