CVE-2026-24064: Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOS

Synopsis

A local privilege escalation vulnerability exists in Waves Central for macOS versions 13.0.9 through 16.5.5, caused by a trusted XPC client component signed with hardened runtime entitlements that permit dynamic library injection. An attacker who already has a low-privilege shell on the host can set the DYLD_INSERT_LIBRARIES environment variable to load an attacker-controlled library into the signed process at launch, bypassing the trust check the privileged helper service uses to authenticate callers. Successful exploitation results in arbitrary code execution as root. A patched-image rebuild at version 16.6.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target system is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; the attacker does not need administrator or root credentials before exploitation.

• Victim interactionNot required

  No action from another user is needed; the attacker can trigger the injection by launching the XPC client process themselves.

• Attack complexityDetail

  The exploit is reliable and condition-free: setting DYLD_INSERT_LIBRARIES before process launch is a straightforward, repeatable technique with no race conditions or memory-layout dependencies.

Blast Radius

• Injected code runs as the trusted XPC client and gains the ability to invoke privileged operations through the helper service, resulting in arbitrary code execution as root.
• An attacker with root execution reads any file on the system, including credential stores, private keys, and application secrets.
• An attacker with root execution writes or replaces any file on the system, including system binaries, launch daemons, and application data.
• An attacker with root execution can crash, disable, or persistently backdoor any process or service on the host.