{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260326-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260326-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Vienna Assistant (MacOS) - Vienna Symphonic Library\n\u00a0vulnerable version: 1.2.542\n      fixed version: -\n         CVE number: CVE-2026-24068\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.vsl.co.at/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-10\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We make products, tools and services that enable all creators and musicians\nto express their deepest emotions through technology, designed to augment\ntheir passion for music and musicality.\n\nSince all of us here at Vienna Symphonic Library are educated musicians,\nsimply passionate about music, or both, we know that every piece of work \u2013\na song for a birthday party, a commercial jingle or a new film score \u2013\nrequires your full attention and energy. That\u2019s why we design our products\nand services to alleviate the burden of unwanted tasks so that you can\nconcentrate on what you enjoy most and get the job done.\"\n\nSource:https://www.vsl.co.at/company/vision\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing XPC Client \u0026 NSXPC endpoint validation leads to privilege escalation (CVE-2026-24068)\nThe VSL privileged helper does utilize NSXPC for IPC. The implementation of\nthe \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework\nto validate if a client should be allowed to connect to the XPC listener,\ndoes not validate clients at all.\n\n-----------------------------------\n1000060b0    bool -[HelperTool listener:shouldAcceptNewConnection:](struct HelperTool* self, SEL sel, id listener, id \nshouldAcceptNewConnection)\n1000060b0    {\n1000060b0        _NSLog(@\"New Listener\");\n1000060fc        [shouldAcceptNewConnection setExportedInterface:[clsRef_NSXPCInterface\n1000060fc            interfaceWithProtocol:protoRef_HelperToolProtocol]];\n100006110        [shouldAcceptNewConnection setExportedObject:self];\n100006120        [shouldAcceptNewConnection resume];\n100006130        return 1;\n1000060b0    }\n-----------------------------------\nThis means that any process can connect to this service using the configured\nprotocol. A malicious process is able to call all the functions defined in\nthe corresponding HelperToolProtocol.\n\n\nNo validation is performed in the functions \"writeReceiptFile\" and \"runUninstaller\"\nof the HelperToolProtocol. This allows an attacker to write files to any\nlocation with any data as well as execute any file with any arguments.\nAny process can call these functions because of the missing XPC client validation\ndescribed before. The abuse of the missing endpoint validation leads to privilege\nescalation.\n\n\nProof of concept:\n-----------------\n1) Missing XPC Client \u0026 NSXPC endpoint validation leads to privilege escalation (CVE-2026-24068)\nTo exploit the missing XPC client validation an attacker only has to define the\nsame Objective C protocol and start a connection to the privileged helper XPC\nservice. The attacker can then use any function available in the defined\nprotocol. The HelperToolProtocol has the functions writeReceiptFile and\nrunUninstaller defined, which both do not perform validation of their arguments.\nThe function runUninstaller can be exploited to execute bash commands as root.\nThe following Objective C code implements the exploit:\n\n-----------------------------------\n[ PoC exploit code removed ]\n-----------------------------------\n\nThe proof of concept code can be compiled using the following command:\n-----------------------------------\nclang -o exploit -framework Foundation ./exploit.mm\n-----------------------------------\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.2.542\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughsupport () vsl co at; no response.\n2026-02-03: Contacting vendor again throughsupport () vsl co at; no response.\n2026-02-24: Vendor Website (https://www.vsl.co.at/) down.\n2026-02-25: Contacted vendor throughsupport () vsl co at andoffice () vsl co at;\n            no response\n2026-03-24: Contacting vendor again, informing them about public release on\n            26th March.\n2026-03-26: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/3"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.vsl.co.at/"
        },
        {
          "url": "https://www.vsl.co.at/company/vision"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260326-0 :: Local Privilege Escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24068",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0248",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/3",
            "automated": true,
            "contentSha256": "be9f0a81affc47398ee86a898c2cf4022a34dba7aab7b839ad4bff3d4566cffb",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-26T10:39:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0248"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0248"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}