Software Center EUVD-2026-12831

Requires Arturia Software Center on macOS with any plugin installed. Attacker needs low-privilege local user account. Victim must initiate plugin uninstall via Arturia Software Center GUI. Exploits world-writable uninstall.sh script to escalate privileges.

This vulnerability presents a severe real-world risk despite the absence of formal CVSS scoring and EPSS data. The attack vector is local (requiring user access to the target macOS system), but the attack complexity is minimal—modifying a world-writable file requires only basic shell knowledge. The privilege impact is critical, as successful exploitation grants root-level code execution. The vulnerability is not known to be actively exploited in the wild (KEV status unavailable), and no public proof-of-concept has been confirmed in the available intelligence sources. However, the technical simplicity of the exploit combined with the guaranteed privilege escalation impact (from local user to root) makes this a high-priority vulnerability for any organization running Arturia Software Center. The lack of CVSS and EPSS scores suggests this may be a recently discovered or lesser-known vulnerability, potentially increasing its risk window before widespread awareness and patching.

A malicious local user on a macOS system with Arturia Software Center installed waits for the legitimate administrator to install or update a plugin through the Software Center application. After the plugin is installed, the attacker navigates to the plugin's installation directory and modifies the uninstall.sh script (which is world-writable) to inject a bash command that creates a new root-privileged user account or installs a backdoor. When the administrator later attempts to uninstall the plugin via the Software Center GUI, the Privileged Helper executes the attacker-modified script with root privileges, granting the attacker persistent root access to the system. No user interaction beyond standard plugin uninstallation is required to trigger the exploit.