PT-2026-47795 · Waves Audio · Waves Central
CVE-2026-24064
·
Published
2026-06-09
·
Updated
2026-06-10
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Waves Central for macOS versions 13.0.9 through 16.5.5
Description
A trusted XPC client component is signed with hardened runtime entitlements that allow dynamic library injection. A local attacker can use the
DYLD INSERT LIBRARIES environment variable to inject a malicious dynamic library into the trusted client process during launch. This allows the injected code to run within the signed process and communicate with the privileged helper service to perform privileged operations, leading to arbitrary code execution with root privileges.Recommendations
Update to version 16.6.2.
Exploit
Fix
LPE
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Waves Central