CVE-2026-24067: Slate Digital Connect macOS XPC PID validation privilege escalation

Synopsis

This is a local privilege escalation vulnerability in Slate Digital Connect 1.37.0 for macOS, caused by a time-of-check time-of-use (TOCTOU) race condition in the privileged helper tool's XPC client validation. The helper authenticates connecting processes by PID, but because PIDs can be reused, a local attacker can win the race so that validation runs against a trusted process rather than the attacker's own. Successful exploitation gives the attacker full read, write, and execution access at the privilege level of the helper tool. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required.

• AuthenticationNot required

  No account credentials or prior authentication are needed to attempt the exploit; any local process can connect to the XPC service.

• Victim interactionNot required

  The race condition is triggered entirely by the attacker's own processes and requires no action from another user.

• Attack complexityDetail

  The attack requires winning a PID-reuse race condition, which introduces timing sensitivity, but the overall exploit is considered reliable under low-complexity conditions per the CVSS AC:L rating.

Blast Radius

• Reads any files or data accessible to the privileged helper tool, including credentials, license keys, and application state stored on the host.
• Writes or modifies files owned by the privileged helper, enabling persistence mechanisms or tampering with application configuration.
• Executes arbitrary code at the privilege level of the helper tool, which on macOS typically runs as root or a high-privilege system account.
• Crashes or destabilizes the helper tool process, disrupting the Slate Digital Connect service for the affected user session.