CVE-2026-24067

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.

• CWE-367

• https://r.sec-consult.com/slate
• https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-in-slate-digital-connect/

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24061telnetd in GNU Inetutils through 2.7 allows remote authentic…9.8
• CVE-2026-24062The "Privileged Helper" component of the Arturia Software Ce…7.8
• CVE-2026-24063When a plugin is installed using the Arturia Software Center…8.2
• CVE-2026-24064Waves Central for macOS versions 13.0.9 through 16.5.5 conta…7.8
• CVE-2026-24065Waves Central for macOS versions 13.0.9 through 16.5.5 conta…8.1
• CVE-2026-24066Slate Digital Connect 1.37.0 for macOS installs a privileged…8.4
• CVE-2026-24068The VSL privileged helper does utilize NSXPC for IPC. The im…8.8
• CVE-2026-24069Kiuwan SAST improperly authorizes SSO logins for locally dis…5.4
• CVE-2026-24070During the installation of the Native Access application, a …8.8
• CVE-2026-24071It was found that the XPC service offered by the privileged …7.8
• CVE-2026-24072An escalation of privilege bug in various modules in Apache …8.8
• CVE-2026-24076Memory Corruption when processing registry values with incor…6.7