CVE-2026-24065: Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOS

Synopsis

This is a local privilege escalation vulnerability in the Waves Central privileged helper service on macOS, affecting versions 13.0.9 through 16.5.5. The helper authenticates connecting XPC clients by checking the client process identifier (PID), but PIDs can be recycled by the operating system, so a local attacker can win a race condition between connection and validation to make the helper trust an attacker-controlled process. Successful exploitation gives the attacker the ability to invoke privileged operations and execute arbitrary code as root. No fix version has been published upstream; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The CVSS vector specifies AV:N, meaning the attacker must reach the service over the network, though in practice the vulnerability description indicates local access is the actual entry point; the network attack vector classification reflects the upstream scoring.

• AuthenticationNot required

  PR:N indicates no credentials or account privileges are required before initiating the exploit.

• Victim interactionNot required

  UI:N means no user action, click, or social engineering is needed; the attacker can proceed entirely without victim participation.

• Attack complexityDetail

  AC:H indicates the attacker must win a race condition between the XPC connection request and the PID validation check, making reliable exploitation dependent on precise timing and process scheduling.

Blast Radius

• Attacker executes arbitrary code with root privileges on the compromised macOS host.
• Attacker reads any file on the filesystem, including credentials, private keys, and application data stored by other users or processes.
• Attacker modifies or replaces system binaries, configuration files, and persisted application data.
• Attacker crashes or manipulates any process on the host, including security tooling and monitoring agents.