CVE-2026-24062

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. This leads to an attacker being able to connect to the helper and execute privileged actions leading to local privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Arturia	Software Center	2.12.0.3157

References

https://r.sec-consult.com/arturia

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-240638.2When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. Thi CVE-2026-240647.8Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component in CVE-2026-240658.1Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. CVE-2026-240668.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240678.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240688.8The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the N CVE-2026-240695.4Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the ap CVE-2026-240708.8During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used b CVE-2026-240717.8It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its cod CVE-2026-240728.8An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the pr CVE-2026-240737.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.CVE-2026-240747.8Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.