{"id":"CVE-2026-24067","title":"Slate Digital Connect macOS XPC PID validation privilege escalation","summary":"Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XP…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-367"],"vendor":"Slate Digital LLC","product":"Slate Digital Connect","affected":["slate_digital_connect < 2.11.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-06-10T14:22:43.985081Z"},"exploitAvailable":true,"published":"2026-06-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T09:55:55.177Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24067","references":[{"url":"https://r.sec-consult.com/slate"}],"tags":["cve.org","exploit-available"],"epss":0.00181,"epssPercentile":0.07706,"ingestedAt":"2026-11-06T10:49:35.404Z","slug":"CVE-2026-24067","body":"## Overview\n\nSlate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.\n\n## Affected\n\n- `slate_digital_connect < 2.11.0`\n\n## Remediation\n\nThe vendor did not respond to the disclosure attempts, and no fixed version was available at the time of publication.\n\nUpdate 2026-11-06:\n\n\n\nThe vendor informs that v2.11.0 fixes the issue since 7th July 2026 now. Furthermore, the app name has changed and is now called Complete Access Hub since v2.0.0.","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}