Vulnerability · Published Mar 18, 2026 · Assigned by SEC-VLab

CVE-2026-24063World-writable uninstall script executed as root in Arturia Software Center

High 8.2

In plain English

A high-severity incorrect default permissions in Software Center from Arturia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.1%top 97.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.

Affected products (as reported)

Vendor	Product	Versions
Arturia	Software Center	2.12.0.3157

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://r.sec-consult.com/arturia third-party-advisory