Vulnerability · Published Jun 9, 2026 · Assigned by SEC-VLab
CVE-2026-24065Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOS
High 8.1
In plain English
A high-severity security flaw in Waves Central from Waves Audio Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Waves Audio Ltd. | Waves Central | 13.0.9 – through 16.5.5 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H