CVE-2026-24066

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing authority. A local attacker can sign a malicious client with a self-signed certificate containing the expected organizational unit value and connect to the privileged XPC service. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-296

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-240678.4Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the CVE-2026-240688.8The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the N CVE-2026-240695.4Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the ap CVE-2026-240708.8During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used b CVE-2026-240717.8It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its cod CVE-2026-240728.8An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the pr CVE-2026-240737.8Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.CVE-2026-240747.8Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.CVE-2026-240757.0Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and ra CVE-2026-240766.7Memory Corruption when processing registry values with incorrect types using a direct query method.CVE-2026-240776.5Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.CVE-2026-240786.5Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.