EUVD-2026-36000
GHSA-gm33-xcxj-p624
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconGain unprivileged local code execution on macOS
-
DeliveryOpen XPC connection to helper.tool2
-
ExploitTerminate connecting process and spray PIDs
-
InstallTrusted Apple-signed binary inherits original PID
-
C2Helper validates reused PID as trusted
-
ExecuteInvoke privileged helper methods
-
ImpactEscalate to root on the workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution as any user on a macOS system with Slate Digital Connect 1.37.0 installed and its privileged helper com.slatedigital.connect.privileged.helper.tool registered and reachable via the XPC service com.slatedigital.connect.privileged.helper.tool2. No additional authentication or user interaction is needed (PR:N/UI:N), and the helper accepts connections from any local process before validation. Limiting factors: the attack vector is local-only (AV:L) so remote exploitation is not possible, exploitation depends on winning a PID-reuse race which requires the attacker to control process creation timing and find a suitable trusted-signed binary to occupy the reused PID, and the target population is narrow - primarily macOS workstations belonging to audio engineers and music producers who installed Slate Digital Connect. |
| Impact | CVSS 8.4 reflects AV:L/AC:L/PR:N/UI:N with high CIA impact - a local, unauthenticated attacker who can run code as any user can reach the XPC endpoint and, on success, obtain root, which is consistent with the description. EPSS is 0.02% (6th percentile), and the vulnerability is not on the CISA KEV list, indicating no observed mass exploitation; this is expected given the niche audience (audio engineers using Slate Digital plugins/Connect) rather than evidence of low real risk. Reliability of the exploit depends on winning a PID-reuse race, which is generally achievable on macOS with PID-spray techniques but adds non-trivial complexity in practice - note that CVSS still scored AC:L, which some defenders may view as optimistic for a TOCTOU race. There is a tension worth flagging: the advisory is published by SEC Consult (a credible disclosing party) but no public POC is referenced in the supplied data, so weaponization potential is plausible but unconfirmed. |
| Exploit ScenarioDerived | An attacker with an unprivileged local shell on a macOS workstation running Slate Digital Connect 1.37.0 launches a malicious process that opens an XPC connection to com.slatedigital.connect.privileged.helper.tool2, then exits and rapidly forks to spray PIDs until its old PID is reassigned to an Apple-signed binary (e.g., /bin/ls) that satisfies the helper's code-signing check. With the PID race won, the helper accepts the original connection as trusted and the attacker invokes privileged helper methods to write files as root, install a persistent root payload, or otherwise achieve local privilege escalation. No public exploit identified at time of analysis, but the SEC Consult advisory link suggests technical detail is publicly documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Local privilege escalation in Slate Digital Connect 1.37.0 for macOS allows unprivileged users on the host to gain root-level capabilities by abusing a TOCTOU race in the privileged helper's XPC client validation. The com.slatedigital.connect.privileged.helper.tool2 service identifies callers by PID and then queries code-signing information, but PID reuse lets an attacker substitute a trusted process between check and use. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but the technical pattern is well-known on macOS and a SEC Consult advisory describes the flaw in detail.
RemediationAI
No vendor-released patch identified at time of analysis in the provided references, so the primary action is to monitor Slate Digital for an updated Connect release that replaces PID-based XPC client validation with audit-token-based validation (via xpc_connection_get_audit_token and SecCodeCopyGuestWithAttributes keyed on the audit token attribute). Until a fix ships, compensating controls include uninstalling Slate Digital Connect on multi-user macOS systems or shared workstations where untrusted local users can run code, and removing the privileged helper from /Library/PrivilegedHelperTools along with its launchd plist in /Library/LaunchDaemons to eliminate the attack surface - the trade-off is that licensing, activation, and any helper-mediated install/update features in Connect will stop working until reinstalled. On single-user creative workstations the practical risk is lower since the attacker already needs local code execution, so monitoring endpoint telemetry for unexpected XPC activity against the helper service is a reasonable interim control. Track the SEC Consult advisory (https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-in-slate-digital-connect/ and https://r.sec-consult.com/slate) and NVD entry for fix availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in a macOS privileged helper installed via SMJobBless-style mechanisms and reachable over XPC (Apple's Mach-port-based IPC framework). The helper authenticates incoming XPC connections by retrieving the connecting peer's PID and then performing code-signing checks (typically via SecCodeCopyGuestWithAttributes or similar APIs keyed on PID). Because PIDs are recycled by the kernel once a process exits, the time window between obtaining the PID and validating its signature creates a classic CWE-367 (Time-of-check Time-of-use) race. Apple's own guidance for years has been to validate XPC peers via audit tokens (xpc_connection_get_audit_token) rather than PIDs, precisely because audit tokens are kernel-supplied and not subject to reuse, which makes this a recurring class of macOS helper-tool flaw rather than a novel discovery.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (551230f0-3615-47bd-b7cc-93e92e730bbf) · only source for this CVE.
CVSS VectorVendor: 551230f0-3615-47bd-b7cc-93e92e730bbf
Lifecycle Timeline
3DescriptionCVE.org
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.
Executive ViewAI
Slate Digital Connect 1.37.0 for macOS contains a local privilege escalation vulnerability (CVSS 8.4) that allows unprivileged users to gain root-level access. No public exploit identified at time of analysis. This affects any organization with macOS systems running this audio software, potentially allowing threat actors or insiders with local access to fully compromise affected hosts.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict local system access via MDM or physical controls; (2) uninstall Slate Digital Connect if not operationally required; (3) disable the com.slatedigital.connect.privileged.helper.tool2 service if core functionality is needed; (4) implement endpoint detection and response (EDR) monitoring for privilege escalation events; (5) enforce macOS System Integrity Protection (SIP).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB