{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260318-0",
          "vendor": "Arturia",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260318-0 \u003e\n=======================================================================\n              title: Multiple Privilege Escalation Vulnerabilities\n            product: Arturia Software Center MacOS\n vulnerable version: 2.12.0.3157\n      fixed version: -\n         CVE number: CVE-2026-24062, CVE-2026-24063\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.arturia.com/technology/asc\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-02\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We create instruments and effects that encourage musical discovery,\nreward curiosity, and savor the artistic process. We\u2019re an international\nteam of passionate people, on a mission to navigate uncharted sonic territory\nin the name of creative empowerment.\nFrom the raw analog power of Brute synthesizers to our faithful virtual\ninstrument emulations of V Collection, we provide musicians with an inspiring\nsonic experience that\u0027s instantly accessible, exploratory, and thrilling.\"\n\nSource:https://www.arturia.com/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Insufficient XPC Client validation (CVE-2026-24062)\nIt was found that the \"Privileged Helper\" component of the Arturia Software\nCenter does not perform sufficient client code signature validation when a\nclient connects. This leads to an attacker being able to connect to the helper\nand execute privileged actions leading to local privilege escalation.\n\n2) World writable uninstall.sh script executed by root (CVE-2026-24063)\nIt was found that when a plugin is installed using the Arturia Software Center,\nthat this plugin also installs an uninstall.sh bash script in a root owned path.\nThis script is written to disk with the file permissions 777, meaning it is\nwritable by any user. When uninstalling a plugin via the Arturia Software Center\nthe Privileged Helper gets instructed to execute this script.\nWhen the bash script is manipulated by an attacker this scenario will lead\nto privilege escalation.\n\n\nProof of concept:\n-----------------\n1) Insufficient XPC Client validation (CVE-2026-24062)\nThe Privileged Helper service does not check if the connecting client\nis signed with a valid code signature. Any process can connect to the\nprivileged helper and trigger privileged actions.\n\nThe following C code can be used to connect to the privileged helper and\ntrigger code execution as root. By first using the FINISHM command to achieve\n/Library/Arturia being a symlink to /tmp/test and then triggering an UNINSTA\nof /Library/Arturia/uninstall.sh, the attacker controlled bash script in\n/tmp/test/uninstall.sh will get executed by root. The following example proof\nof concept sets up the /tmp/test directory as well as the\n/tmp/test/uninstall.sh script containing commands to add the user lowpriv\nto the sudoers file.\n-----------------\n[ PoC exploit code removed ]\n-----------------\n\nThe code can be compiled using clang:\n-----------------\nclang -o exploit exploit.c\n-----------------\n\nAnd then be executed like:\n-----------------\n./exploit com.Arturia.InstallHelper\n-----------------\n\nThis will trigger execution of /tmp/test/uninstall.sh as root\nleading to privilege escalation.\n\n\n2) World writable uninstall.sh script executed by root (CVE-2026-24063)\nWhen a vst is installed via the ASC the following path will be generated:\n-----------------\n/Library/Arturia/Acid V/Acid V.vst3/Contents/Resources\n-----------------\nThe following contents are installed:\n-----------------\nuser@usersVilMachine Resources % ls -al\ntotal 8\ndrwxrwxrwx  3 root  wheel    96 Oct  9 09:27 .\ndrwxrwxrwx  7 root  wheel   224 Oct  9 09:27 ..\n-rwxrwxrwx  1 root  wheel  3315 Oct  9 09:26 uninstall.sh\nuser@usersVilMachine Resources % pwd\n/Library/Arturia/Acid V/Acid V.vst3/Contents/Resources\n-----------------\nWhen uninstalling the same software via the ASC the following XPC message\nis sent to the InstallHelper:\n-----------------\nUNINSTA /Library/Arturia/Acid V/Acid V.vst3/Contents/Resources/uninstall.sh\n-----------------\nThis will trigger execution of the uninstall.sh file as root.\nThe uninstallation can either be triggerd by exploiting the missing\nXPC client authentication of the Privileged Helper or by manually\ntriggering the uninstall via the UI.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 2.12.0.3157\n\nAll tests have been performed on MacOS 26.2 with SIP enabled!\n\n\nVendor contact timeline:\n------------------------\n2026-01-05: Contacting vendor throughinfo () arturia com; no response.\n2026-01-27: Contacting vendor through contact form. Got error, \"Support out of reach!\"\n2026-01-27: Contact via contact form again, seems to have a bug.\n2026-01-27: Contact viainfo () arturia com andwebmaster () arturia com; no response.\n2026-02-03: Tried to contact vendor via contact form after login. Got same error.\n2026-02-03: Contact viasales.support () arturia com; no response.\n2026-02-24: Tried to contact vendor via contact form, again same error.\n2026-02-25: Contact viaprivacy-inquiries () arturia com; no response.\n2026-03-18: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:41:10Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/9"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.arturia.com/company"
        },
        {
          "url": "https://www.arturia.com/technology/asc"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260318-0 :: Multiple Privilege Escalation Vulnerabilities in Arturia Software Center MacOS",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24062",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24063",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0276",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/9",
            "automated": true,
            "contentSha256": "3d07ec840f6a5098807bac32b8cf27bf98c69ef58cec128ce317988d74ea12ae",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-18T15:39:22Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0276"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:41:10Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0276"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}