CVE-2024-14032

Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.

• CWE-862

• https://help.twitch.tv/s/article/recommended-software-for-broadcastingProduct
• https://help.twitch.tv/s/topic/0TO3a000000kZfYGAU/twitch-studioProduct
• https://www.iru.com/blog/twitch-privileged-helperExploit, Third Party Advisory
• https://www.vulncheck.com/advisories/twitch-studio-launcherhelper-xpc-missing-authorization-to-root-file-writeThird Party Advisory

Published

Apr 6, 2026

Last Modified

Sep 26, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-14027In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-14028Use after free vulnerability in Softing smartLink HW-DP or s…6.5
• CVE-2024-14029Tornado before 6.4.1 ignores duplicate Transfer-Encoding: ch…7.5
• CVE-2024-1403In OpenEdge Authentication Gateway and AdminServer prior to …9.8
• CVE-2024-14030Sereal::Decoder versions from 4.000 through 4.009_002 for Pe…8.1
• CVE-2024-14031Sereal::Encoder versions from 4.000 through 4.009_002 for Pe…8.1
• CVE-2024-14033Hirschmann EagleSDV firmware prior to 05.4.02 contains a den…8.7
• CVE-2024-14034Hirschmann HiEOS devices versions prior to 01.1.00 contain a…9.8
• CVE-2024-14036Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 co…8.7
• CVE-2024-14037Redsea Cloud eHR contains an arbitrary file upload vulnerabi…9.8
• CVE-2024-1404A vulnerability was found in Linksys WRT54GL 4.30.18 and cla…7.5
• CVE-2024-14040In the Linux kernel, the following vulnerability has been re…7.8