Waves Central EUVD-2026-74192

Exploitation requires an authenticated local user account on a macOS system (PR:L) running Waves Central with the privileged helper service active. The critical enabling condition is that the attacker must be able to execute code within a process that carries the Waves code-signing certificate - achieved by injecting a dylib into a running Waves-signed process, exploiting a separate code execution primitive within the Waves application suite, or otherwise running under the Waves signing identity. This is an additional practical hurdle beyond simple local access, though not reflected in AC:L. No network access, special configuration, or user interaction is required. Exploitation is strictly limited to macOS (the XPC mechanism is macOS-specific and the vulnerability does not apply to Windows or other platforms). Systems running Waves Central 17.0 or later are not affected.

The CVSS 4.0 score of 8.4 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects the real-world risk profile: a local, authenticated standard user can escalate to root with low attack complexity and no user interaction required. The attack surface is limited to macOS systems with Waves Central installed and the privileged helper service active. No CISA KEV listing is present, and no POC code is referenced in the available intelligence. EPSS data is absent. The 'Authentication Bypass' tag in the input is a loose fit - this is a missing XPC client authorization check enabling privilege escalation, not a bypass of the authentication process itself; the attacker is already a valid system user (PR:L). The Apple tag is accurate given the macOS XPC specificity. Real-world risk is meaningful in audio production environments (recording studios, post-production houses, broadcast facilities) but is bounded by the local-only attack vector, substantially differentiating it from network-exploitable privilege escalation vulnerabilities.

A local user on a macOS workstation running unpatched Waves Central loads a dynamic library or injects code into an existing Waves-signed process, giving their execution context the Waves code-signing certificate chain. They open an XPC connection to the privileged helper, which compares the certificate chain and finds it equal to its own, granting authorization. The attacker then instructs the helper to execute an attacker-controlled shell script as root, achieving full local system compromise.