CVE-2026-24063

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-240647.8Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component in CVE-2026-240658.1Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. CVE-2026-240668.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240678.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240688.8The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the N CVE-2026-240695.4Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the ap CVE-2026-240708.8During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used b CVE-2026-240717.8It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its cod CVE-2026-240728.8An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the pr CVE-2026-240737.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.CVE-2026-240747.8Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.CVE-2026-240757.0Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and ra