Deskin CVE-2026-11318

Requires an existing local, unprivileged account or code-execution foothold on a macOS host that has Deskin (version ≤3.3.4.3) installed with its root-owned com.deskin.service.installer XPC service running. The decisive flaw is that this XPC service performs no client authentication (CWE-306), so any local process can connect and invoke the privileged installer method with an attacker-controlled installer package. Limiting factors: exploitation is not remote (AV:L) - the attacker must already be on the host; it depends on Deskin being installed and its privileged installer service being active; and it provides escalation, not initial access, so it must be chained with a separate initial-access technique.

This is a credible, actionable local privilege escalation rather than a hype-inflated high-CVSS issue, but its risk is bounded by the local attack vector. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes an attacker who already has an unprivileged foothold on the macOS host and can trivially (low complexity, no user interaction) reach the root-owned com.deskin.service.installer XPC service, which performs no authentication (CWE-306) - yielding VC:H/VI:H/VA:H, i.e. full root compromise. Publicly available exploit code exists (GitHub, Cr0wld3r) and the issue was reported by VulnCheck, which raises practical exploitability and lowers the attacker's bar considerably. However, no EPSS score, KEV listing, or SSVC decision was supplied in the input, so I cannot confirm active in-the-wild exploitation or widespread automated use - the signals indicate a working public PoC, not confirmed mass exploitation. The one point to verify: the vector is strictly local (AV:L), so this is a post-compromise escalation primitive (e.g. chaining after phishing/initial access or on multi-user hosts), not a remote entry point; treat it as a high-priority patch on affected macOS endpoints but not an internet-facing emergency.

An attacker who has already gained unprivileged code execution on a macOS machine running Deskin (≤3.3.4.3) connects directly to the root-owned com.deskin.service.installer XPC service and, because the service requires no authentication, invokes its privileged installer method pointing at an attacker-supplied installer package. The package executes as root, giving full system compromise. A public proof-of-concept for this chain is available on GitHub (Cr0wld3r/CVE-2026-11318).