FKIE_CVE-2026-24068

Vulnerability from fkie_nvd - Published: 2026-03-26 11:16 - Updated: 2026-04-03 06:16
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all. This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol. No validation is performed in the functions "writeReceiptFile" and “runUninstaller” of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.
References
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://r.sec-consult.com/vsl
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2026/Apr/3
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The VSL privileged helper does utilize NSXPC for IPC. The implementation of the \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all.\u00a0This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol.\u00a0No validation is performed in the functions \"writeReceiptFile\" and \u201crunUninstaller\u201d of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation."
    },
    {
      "lang": "es",
      "value": "El asistente privilegiado de VSL utiliza NSXPC para IPC. La implementaci\u00f3n de la funci\u00f3n \u0027shouldAcceptNewConnection\u0027, que es utilizada por el framework NSXPC para validar si a un cliente se le debe permitir conectarse al oyente XPC, no valida a los clientes en absoluto. Esto significa que cualquier proceso puede conectarse a este servicio utilizando el protocolo configurado. Un proceso malicioso puede llamar a todas las funciones definidas en el HelperToolProtocol correspondiente. No se realiza ninguna validaci\u00f3n en las funciones \u0027writeReceiptFile\u0027 y \u0027runUninstaller\u0027 del HelperToolProtocol. Esto permite a un atacante escribir archivos en cualquier ubicaci\u00f3n con cualquier dato, as\u00ed como ejecutar cualquier archivo con cualquier argumento. Cualquier proceso puede llamar a estas funciones debido a la falta de validaci\u00f3n del cliente XPC descrita anteriormente. El abuso de la falta de validaci\u00f3n del endpoint conduce a la escalada de privilegios."
    }
  ],
  "id": "CVE-2026-24068",
  "lastModified": "2026-04-03T06:16:06.463",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-26T11:16:20.097",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/vsl"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2026/Apr/3"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.