CVE-2026-24066

Name of the Vulnerable Software and Affected Versions Slate Digital Connect version 1.37.0

Description The software installs a privileged helper tool, 'com.slatedigital.connect.privileged.helper.tool', which exposes the XPC service 'com.slatedigital.connect.privileged.helper.tool2'. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and fails to verify that the certificate chains to a trusted code-signing authority. A local attacker can sign a malicious client with a self-signed certificate containing the expected organizational unit value to connect to the privileged XPC service, potentially leading to local privilege escalation through unauthorized access to privileged helper functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.