Software Center EUVD-2026-12829

Requires low-privilege local user access on macOS running Arturia Software Center. Attacker must be able to connect to the Privileged Helper component and send crafted requests. No user interaction needed. Default installations are vulnerable.

This vulnerability presents a significant real-world risk despite the absence of a formal CVSS score or EPSS metric. The attack vector is local (requires attacker presence or code execution on the target system), and the attack complexity is low since no special conditions are required—any local process can connect to an unguarded IPC endpoint. The authentication bypass (CWE-306) combined with privilege escalation creates a direct path to elevated privileges, which in the SSVC framework represents a technical impact of complete system compromise. While no public proof-of-concept or KEV listing is documented, the vulnerability class (authentication bypass on privileged IPC) is well-understood and historically trivial to exploit once the vulnerable component is identified. The lack of CVSS/EPSS data suggests either recent discovery or delayed disclosure; however, the simplicity of the flaw (missing signature validation on a privileged helper) indicates high exploitability if attackers gain knowledge of its existence. For macOS systems running Arturia Software Center, this should be treated as a critical priority, particularly in environments where supply-chain or local threat models are relevant.

An attacker with local access to a macOS system (either through prior code execution, physical access, or a separate vulnerability) can create a malicious application or script that connects to the Arturia Software Center Privileged Helper via XPC without providing valid code signature credentials. The helper, failing to validate the client's identity, accepts the connection and processes commands from the attacker's process, allowing the attacker to execute privileged operations such as modifying system files, installing kernel extensions, or creating new privileged accounts. This transforms local access into root-level privilege escalation, giving the attacker complete control over the system. The attack complexity is low because the only requirement is the ability to execute code locally; no special timing, user interaction, or system configuration is needed.