{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260202-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260202-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n            product: Native Instruments - Native Access (MacOS)\n vulnerable version: verified up to 3.22.0\n      fixed version: n/a\n         CVE number: CVE-2026-24070, CVE-2026-24071\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.native-instruments.com/en/specials/native-access/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-07-22\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Native Instruments is a leading manufacturer of software and hardware\nfor computer-based audio production and DJing. In June of 2023, iZotope,\nPlugin Alliance and Brainworx joined us in our mission to develop innovative,\nfully-integrated solutions for every creative task, profession, and skill level.\"\n\nSource:https://www.native-instruments.com/en/company/\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unreachable and did not respond to multiple contact attempts.\nNo patch is available. Customers should contact the vendor and request a\npatch.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24070)\nDuring the installation of the Native Access application, a privileged helper\n`com.native-instruments.NativeAccess.Helper2`, which is used by Native Access\nto trigger functions via XPC communication like copy-file, remove or\nset-permissions, is deployed as well.\n\nThe communication with the XPC service of the privileged helper is only allowed\nif the client process is signed with the corresponding certificate and\nfulfills the following code signing requirement:\n\"anchor trusted and certificate leaf[subject.CN] = \\\"Developer ID Application: Native Instruments GmbH (83K5EG6Z9V)\\\"\"\n\nThe Native Access application was found to be signed with the\n`com.apple.security.cs.allow-dyld-environment-variables` and\n`com.apple.security.cs.disable-library-validation` entitlements leading to DYLIB\ninjection and therefore command execution in the context of this application.\n\nA low privileged user can exploit the DYLIB injection to trigger functions of\nthe privileged helper XPC service resulting in privilege escalation by first\ndeleting the /etc/sudoers file and then copying a malicious version of that file\nto /etc/sudoers.\n\n\n2) XPC Client Validation via PID (CVE-2026-24071)\nIt was found that the XPC services uses the PID of the connecting client to\nverify its code signature. This is considered insecure and can be exploited\nby PID reuse attacks.\n\nThe connection handler function uses _xpc_connection_get_pid(arg2) as argument\nfor the hasValidSignature function. This value can not be trusted since it is\nvulnerable to PID reuse attacks.\n----------------------------------------------------------------------------\n10000a60c    int64_t ___main_block_invoke(int64_t arg1, xpc_object_t arg2)\n\n10000a630        if (_xpc_get_type(object: arg2) != __xpc_type_connection)\n10000a64c            return _syslog$DARWIN_EXTSN(5, \"Unexpected type\")\n10000a64c\n10000a65c        if ((hasValidSignature(_xpc_connection_get_pid(arg2)) \u0026 1) == 0)\n10000a66c            _syslog$DARWIN_EXTSN(5, \"Refused connection from client with bad signature\")\n10000a674            _xpc_connection_cancel(arg2)\n10000a674\n10000a684        _xpc_connection_set_event_handler(arg2, \u0026___block_literal_global)\n10000a694        return _xpc_connection_activate(arg2) __tailcall\n----------------------------------------------------------------------------\n\n3) No Path validation in Delete and Copy file\nWhen triggering file copy or delete call via XPC, the service does not check if it\nshould be allowed to delete or copy the file. No restrictions are applied for\ncopying or deleting files. These missing restrictions lead to privilege escalation\ndue to the possibility to delete and then write to /etc/sudoers or /Library/LaunchDaemons.\n\nThis issue is not exploitable on its own without a vulnerability allowing for\nconnection to the privileged helper. However the other two vulnerabilities\ndescribed in this advisory allow exactly that.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24070)\nTo check for the dangerous entitlements\n`com.apple.security.cs.allow-dyld-environment-variables` and\n`com.apple.security.cs.disable-library-validation` the \"codesign\" utility of\nMacOS can be used:\n\n----------------------------------------------------------------------------\nlowpriv@Users-Mac exploit % codesign -dvv --entitlements :- /Applications/Native\\ Access.app/Contents/MacOS/Native\\ \nAccess\nExecutable=/Applications/Native Access.app/Contents/MacOS/Native Access\nIdentifier=com.native-instruments.nativeaccess2\n[...]\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST \n1.0//EN\"\"https://www.apple.com/DTDs/PropertyList-1.0.dtd\";\u003e\u003cplist version=\"1.0\"\u003e\n        \u003cdict\u003e\n                \u003ckey\u003ecom.apple.security.cs.allow-dyld-environment-variables\u003c/key\u003e\n                \u003ctrue/\u003e\n                \u003ckey\u003ecom.apple.security.cs.allow-jit\u003c/key\u003e\n                \u003ctrue/\u003e\n                \u003ckey\u003ecom.apple.security.cs.allow-unsigned-executable-memory\u003c/key\u003e\n                \u003ctrue/\u003e\n                \u003ckey\u003ecom.apple.security.cs.disable-library-validation\u003c/key\u003e\n                \u003ctrue/\u003e\n        \u003c/dict\u003e\n\u003c/plist\u003e\n----------------------------------------------------------------------------\n\nThe privileged helper located at\n/Library/PrivilegedHelperTools/com.native-instruments.NativeAccess.Helper2\nwas found to check the code signature of the XPC client before running any\naction. Due to the DYLIB injection vulnerability in the Native Access executable\nit is possible to execute code in the context of the process of Native Access\nwhich has a valid signature for the needed Team ID. The XPC service exposed\nmultiple functions, e.g. copy-file and remove.\n\nThe following code was used to craft a malicious DYLIB, which on load connects\nto the privileged helper XPC service and deletes the /etc/sudoers file as such\nthat it can then copy a malicious version of the sudoers file to /etc/sudoers.\n\n[ PoC exploit code removed ]\n\nOn a Mac system with the developer tools installed the PoC library can be compiled\nas follows:\n\n----------------------------------------------------------------------------\n$ clang -framework Foundation -dynamiclib -o libxpcclient.dylib libxpcclient.m\n----------------------------------------------------------------------------\n\nBefore running the exploit ensure that the file /tmp/bad_sudoers exists and\nis a valid sudoers file! The exploit can then be executed using the DYLIB\ninjection:\n\n----------------------------------------------------------------------------\n$ DYLD_INSERT_LIBRARIES=\u003cpath_to_DYLIB\u003e \"/Applications/Native Access.app/Contents/MacOS/Native Access\"\n----------------------------------------------------------------------------\n\nThe bad_sudoers file will then be copied to /etc/sudoers.\n\n----------------------------------------------------------------------------\nlowpriv@Users-Mac ~ % id\nuid=503(lowpriv) gid=20(staff) \ngroups=20(staff),12(everyone),61(localaccounts),399(com.apple.access_ssh-disabled),701(com.apple.sharepoint.group.1),703(com.apple.sharepoint.group.3),100(_lpoperator),702(com.apple.sharepoint.group.2)\nlowpriv@Users-Mac ~ % sudo id\nPassword:\nlowpriv is not in the sudoers file.\nThis incident has been reported to the administrator.\n\nlowpriv@Users-Mac ~ % DYLD_INSERT_LIBRARIES=/Users/lowpriv/Desktop/exploit/libxpcclient.dylib \"/Applications/Native \nAccess.app/Contents/MacOS/Native Access\"\n2025-07-22 05:38:03.334 Native Access[35760:498359] [+] Dylib loaded. Starting XPC communication...\n2025-07-22 05:38:03.458 Native Access[35760:498359] Received reply:\n2025-07-22 05:38:03.458 Native Access[35760:498359] success: \u003cbool: 0x20a033370\u003e: true\n2025-07-22 05:38:03.466 Native Access[35760:498359] Received reply:\n2025-07-22 05:38:03.466 Native Access[35760:498359] success: \u003cbool: 0x20a033370\u003e: true\n^C\n\nlowpriv@Users-Mac ~ % sudo id\nPassword:\nuid=0(root) gid=0(wheel) \ngroups=0(wheel),1(daemon),2(kmem),3(sys),4(tty),5(operator),8(procview),9(procmod),12(everyone),20(staff),29(certusers),61(localaccounts),80(admin),701(com.apple.sharepoint.group.1),703(com.apple.sharepoint.group.3),33(_appstore),98(_lpadmin),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh-disabled),400(com.apple.access_remote_ae),702(com.apple.sharepoint.group.2)\n----------------------------------------------------------------------------\n\n\n2) XPC Client Codesign via PID (CVE-2026-24071)\nTo exploit the PID usage for the client validation, a known PID reuse attack\ncan be used. There are several templates for this attack available.\nThe following code can be used to exploit this:\n\n[ PoC exploit code removed ]\n\n\n3) No Path validation in Delete and Copy file\nNo PoC available.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following versions have been tested on MacOS Sequoia and MacOS Tahoe:\n* verified on 3.18.1, 3.19.0, 3.20.1, 3.21.0, 3.21.1 and up to 3.22.0\n  (potentially all lower versions might be vulnerable too).\n\n\nVendor contact timeline:\n------------------------\n2025-07-23: Contacting vendor throughinfo () native-instruments com; No response\n2025-08-07: Contacting vendor again, adding various other emails\n            found on the website. No response.\n2025-09-16: Trying to establish contacts via LinkedIn. No response.\n2025-10-13: Registering support account and using \"Support Chat\" function.\n            No response except spam newsletters.\n2026-02-02: Release of advisory.\n\n\nSolution:\n---------\nThe vendor was unreachable and did not respond to multiple contact attempts.\nNo patch is available. Customers should contact the vendor and request a\npatch.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://secli"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/4"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.apple.com/DTDs/PropertyList-1.0.dtd\""
        },
        {
          "url": "https://www.native-instruments.com/en/company/"
        },
        {
          "url": "https://www.native-instruments.com/en/specials/native-access/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260202-0 :: Multiple vulnerabilities in Native Instruments Native Access (MacOS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24070",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24071",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0189",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/4",
            "automated": true,
            "contentSha256": "e8b6e5c1d222541daa077cc0ae350faec1f94331ec0695f4d95b8fa00bdeecf6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-02T14:34:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0189"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0189"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}