malloc error on macOS Sequoia: pointer being freed was not allocated - crashes on login

[motorthings]

Summary:
LastPass CLI crashes immediately on login with a malloc error on macOS Sequoia 15.6.

Environment:

• OS: macOS Sequoia 15.6 (Darwin 24.6.0)
• Architecture: Apple Silicon (arm64)
• LastPass CLI version: 1.6.1_2 (installed via Homebrew)
• Installation method: brew install lastpass-cli

Steps to Reproduce:

1. Install lastpass-cli via Homebrew: brew install lastpass-cli
2. Run: lpass login <email>
3. Observe immediate crash before password prompt

Expected Behavior:
The command should prompt for the master password and proceed with login.

Actual Behavior:
The command crashes immediately with a malloc error:
lpass(78847,0x1fbe220c0) malloc: *** error for object 0x600000000001: pointer being freed was not allocated
lpass(78847,0x1fbe220c0) malloc: *** set a breakpoint in malloc_error_break to debug
zsh: abort lpass login motorthings@gmail.com

Additional Context:

• The error occurs with both default execution and with LPASS_DISABLE_PINENTRY=1
• All lpass commands appear to trigger the same malloc error
• The issue prevents any use of the CLI

Related Issues:
Similar malloc errors have been reported on previous macOS versions:

• macOS Mojave segmentation faults and malloc errors #447 (macOS Mojave)
• segfault on macos catalina #513 (macOS Catalina)
• Segfaults on macOS Mojave Beta #427 (macOS Mojave Beta)

This appears to be a continuation of the library compatibility issues on newer macOS versions.

[jacmacmod]

I have had the issue many times. Not sure what fixes it but creating new terminal windows seems to help me login but when trying to use tokens I still get that issue so have reverted to saving keys in env variables for now.

[aclevername]

Seeing this on Tahoe as well (related: #731)

[jakegage]

I can confirm that I've been seeing this for weeks on Sequoia.

[abaines]

I'm pretty sure I'm also encountering this issue with the machine:

Chip Apple M4 Pro
macOS Sequoia 15.7.3

Seems related to #427 and #550 issues.

Hoping for an official LastPass recommended steps to fix this soon.

Thanks! 🤗

[jdbaudean]

I'm seeing this too, are there any workarounds?

ProductName:		macOS
ProductVersion:		15.7.3
BuildVersion:		24G419

[lhaeger]

I got exactly this error after upgrading macOS 15.7.3 --> 15.7.4 today. Seems to be related to macOS' curl version. I tried compiling lpass from source while pointing it at the Homebrew curl version (rather than letting it use macOS' curl) and that solved the issue for me:

• brew uninstall lastpass-cli
• brew install curl
• git clone https://github.com/lastpass/lastpass-cli.git
• edit the Makefile to begin as follows:

# changed to /usr/local
PREFIX ?= /usr/local
MANDIR ?= $(PREFIX)/share/man
BUILDDIR=build
CMAKEMAKE=$(BUILDDIR)/Makefile
# added -DCMAKE_POLICY_VERSION_MINIMUM=3.5
CMAKEOPTS=-DCMAKE_INSTALL_PREFIX:PATH=$(PREFIX) -DCMAKE_INSTALL_MANDIR:PATH=$(MANDIR) -DCMAKE_POLICY_VERSION_MINIMUM=3.5
# added the following lines
LDFLAGS="-L/opt/homebrew/opt/curl/lib"
CPPFLAGS="-I/opt/homebrew/opt/curl/include"
PKG_CONFIG_PATH="/opt/homebrew/opt/curl/lib/pkgconfig"

• make && make install
• add /usr/local/bin to your PATH

[wfaulk]

You can do the equivalent thing within homebrew by running brew edit lastpass-cli, deleting the line uses_from_macos 'curl', adding the line depends_on 'curl' immediately above the depends_on 'openssl@3' line, saving that, and then reinstalling with HOMEBREW_NO_INSTALL_FROM_API=1 brew reinstall --build-from-source lastpass-cli.

I have submitted a PR to get this applied within homebrew.

[LittaKake]

You can do the equivalent thing within homebrew by running brew edit lastpass-cli, deleting the line uses_from_macos 'curl', adding the line depends_on 'curl' immediately above the depends_on 'openssl@3' line, saving that, and then reinstalling with HOMEBREW_NO_INSTALL_FROM_API=1 brew reinstall --build-from-source lastpass-cli.

I have submitted a PR to get this applied within homebrew.

Seems like your PR is merged. I reinstalled lpass cli and everything works as expected now.