EUVD-2026-74192
GHSA-pvv8-qxr5-pq93
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with standard user account (PR:L), no complexity or interaction; root script execution yields C:H/I:H; A:N as helper process availability is unaffected by the exploit.
Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725).
CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725
Lifecycle Timeline
3DescriptionCVE.org
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
AnalysisAI
Local privilege escalation in Waves Central for macOS (versions up to 16.6.2) allows any authenticated local user to gain root code execution by abusing a flawed XPC client authorization scheme in the product's privileged helper service. The helper validates connecting XPC clients by performing a certificate-chain equality comparison against itself rather than enforcing a pinned code requirement (application identifier and Apple Team ID), meaning any process carrying the Waves signing certificate can impersonate a legitimate client and instruct the helper to run arbitrary scripts as root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local user account on a macOS system (PR:L) running Waves Central with the privileged helper service active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects the real-world risk profile: a local, authenticated standard user can escalate to root with low attack complexity and no user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Waves Central to version 17.0 or later, which contains the vendor-released fix for the XPC client authorization flaw, as documented in the vendor release notes at https://www.waves.com/downloads/release-notes#v17 and the CISA CSAF advisory va-26-251-02. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all macOS systems running Waves Central versions 16.6.2 and earlier using endpoint management or inventory tools, prioritizing audio production and creative workstations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today