{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Slate Digital Connect (macOS)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260610-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Slate Digital Connect (macOS)\n\u00a0vulnerable version: 1.37.0\n      fixed version: -\n         CVE number: CVE-2026-24066, CVE-2026-24067\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://app.completeaccess.audio/installers,https://slatedigital.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-09\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Slate Digital was founded in 2008 with a mission to deliver exceptional audio\nproduction tools to musicians, engineers, producers, and content creators. With\nour extensive expertise and knowledge, we are constantly evolving to stay in\nstep with the changing needs of modern creatives. Our goal is to inspire and\nempower individuals of all skill levels to do their best work and share it\nwith the world.\"\n\n\"Slate Digital Connect lets you install, activate, and update all Slate Digital\nplugins. Whether you need a fresh install, to move to a new machine, or to grab\nthe latest updates, Slate Digital Connect handles downloads, licenses, and\nupgrades automatically.\"\n\nSource:https://slatedigital.com/about/ \u0026https://app.completeaccess.audio/installers\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive since January 2026 and a patch is not available.\nUsers of this software should contact the vendor support and demand a patch.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege escalation by insufficient XPC Client validation (CVE-2026-24066)\nThe Slate Digital Connect App installs a helper tool during installation. The\nhelper tool namely `com.slatedigital.connect.privileged.helper.tool` is installed\ninto `/Library/PrivilegedHelperTools`. It offers the XPC service\n`com.slatedigital.connect.privileged.helper.tool2`.\n\nIt was found that the client validation of the XPC service is insufficient.\nThe following snippet of the decompiled function \"isValidClient\" shows that\nonly a check regarding the subject.OU of the certificate is performed. It is\nnot verified that this certificate is signed by Apple.\n\n-----------------------------------\n100003050            if (_SecRequirementCreateWithString(\n100003050                    @\"certificate leaf[subject.OU] = \"3F5JHDQ8FZ\"\", 0, \u0026cf_2))\n100003054                goto label_100003068;\n-----------------------------------\n\nThis can be exploited by creating a self-signed certificate for code signing.\nThis enables attackers to craft their own self-signed certificate with the\ncorresponding subject.OU.\n\n2) Insecure XPC Client validation via PID (CVE-2026-24067)\nThe function \"isValidClient\" gets the code signing information of the\nconnecting process by using its PID:\n-----------------------------------\n100002fbc        SecRequirementRef cf_2 = nullptr;\n100002fcc        SecCodeRef var_28 = nullptr;\n100002fd4        int32_t pid = _xpc_connection_get_pid();\n100002fe0        CFAllocatorRef allocator = *(uint64_t*)_kCFAllocatorDefault;\n100002ff4        CFNumberRef values = _CFNumberCreate(allocator, kCFNumberSInt32Type, \u0026pid);\n100003014        CFDictionaryRef cf = _CFDictionaryCreate(allocator, _kSecGuestAttributePid,\n100003014            \u0026values, 1, nullptr, nullptr);\n100003038        bool z;\n100003038\n100003038        if (!_SecCodeCopyGuestWithAttributes(nullptr))\n100003038            z = !var_28;\n100003038        else\n100003038            z = true;\n100003038\n10000303c        int64_t result;\n10000303c        SecRequirementRef cf_1;\n-----------------------------------\n\nThis is considered not secure, since it is possible to exploit this case\nby exploiting PID reuse.\n\n\nProof of concept:\n-----------------\n1) Local Privilege escalation by insufficient XPC Client validation (CVE-2026-24066)\nTo exploit this issue a rogue code signing certificate must be created:\n-----------------------------------\nopenssl genrsa -out codesign.key 4096\n\nopenssl req -new -x509 \\\n  -key codesign.key \\\n  -out codesign.crt \\\n  -days 3650 \\\n  -subj \"/CN=My Self Signed Code Cert/OU=3F5JHDQ8FZ/O=Test Org/C=US\" \\\n  -addext \"keyUsage=digitalSignature\" \\\n  -addext \"extendedKeyUsage=codeSigning\"\n\nopenssl pkcs12 -export \\\n  -inkey codesign.key \\\n  -in codesign.crt \\\n  -out codesign.p12\n-----------------------------------\n\nThis codesign.p12 certificate can then be imported into the keychain.\nThe following C code has been crafted to exploit the PrivilegedHelperTool:\n-----------------------------------\n[ POC removed ]\n-----------------------------------\n\nThis code was compiled by:\n-----------------------------------\nclang -o slateExploit main.c\n-----------------------------------\n\nand then signed with the crafted certificate created before:\n-----------------------------------\ncodesign --sign \"My Self Signed Code Cert\" \\\n         --force \\\n         slateExploit\n-----------------------------------\n\nThis executable can then be transferred to a target device and be executed as\nshown in the screenshot ExploitProof.png\n\n\n2) Insecure XPC Client validation via PID (CVE-2026-24067)\nTo exploit the insecure client validation via PID, the following Objective C\ncode can be used. The code first sends the desired XPC message and then\nquickly changes the process to the benign binary, leading to the PID,\nwhich will be used to check if the client should be allowed to connect\nto the service or not, pointing to the benign client.\n\n-----------------------------------\n[ POC removed ]\n-----------------------------------\n\nThe code can be compiled using clang:\n-----------------------------------\nclang -o slatepidexploit -framework foundation pidReuseSlate.c\n-----------------------------------\n\nThe pid reuse attack will then be performed and the command defined\nin the XPC message will be executed by root. This again enables several\nvectors for local privilege escalation.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.37.0\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927\n2026-02-02: Contacting vendor by answering to the email received when\n            creating a ticket. No response.\n2026-02-24: Contacting vendor again through \ntickethttps://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927\n2026-04-07: Contacting vendor viahelpdesk () slatedigital com; No response.\n2026-04-28: Tried contactingprivacy () slatedigital com, email seems to not exist:\n            \"Your message dated on 28 Apr 2026 07:52:04 -0000 toprivacy () slatedigital com\n            couldn\u0027t be delivered due to the following error:\n            5.1.0 - Unknown address error 550-\u00275.4.1 Recipient address rejected:\n            Access denied\"\n2026-04-28: Contactinginfo () audiotonix com; No response.\n2026-06-10: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive since January 2026 and a patch is not available.\nUsers of this software should contact the vendor support and demand a patch.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/7"
        },
        {
          "url": "https://app.completeaccess.audio/installers"
        },
        {
          "url": "https://app.completeaccess.audio/installers,https://slatedigital.com/"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://slatedigital.com/about/"
        },
        {
          "url": "https://support.slatedigital.com/hc/en-us/requests/new?ticket_form_id=360000126927"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260610-0 :: Local Privilege Escalation in Slate Digital Connect (macOS)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24066",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24067",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0366",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/7",
            "automated": true,
            "contentSha256": "4296eee822e8b196734ef37c00e2a72fc22b617ce67067d8b74fe4d9f3099418",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-10T10:34:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0366"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0366"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}