CVE-2026-24065— Waves Central 安全漏洞

Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOS

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.

N/A

检查时间与使用时间(TOCTOU)的竞争条件

Waves Central 安全漏洞

Waves Central是Waves公司的一款音频软件许可证与产品管理工具。 Waves Central for macOS 13.0.9版本至16.5.5版本存在安全漏洞，该漏洞源于特权助手服务使用进程标识符验证XPC客户端，可能导致本地攻击者利用竞争条件使助手信任攻击者控制的进程，从而以root权限执行任意代码。

N/A

N/A