Waves Audio Waves Central up to 16.5.5 Trusted XPC Client untrusted search path

Summaryinfo

A vulnerability, which was classified as problematic, was found in Waves Audio Waves Central up to 16.5.5. This issue affects some unknown processing of the component Trusted XPC Client. Such manipulation leads to untrusted search path. This vulnerability is referenced as CVE-2026-24064. The attack can only be performed from a local environment. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Waves Audio Waves Central up to 16.5.5. Affected by this issue is some unknown functionality of the component Trusted XPC Client. The manipulation with an unknown input leads to a untrusted search path vulnerability. Using CWE to declare the problem leads to CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process at launch. The injected code runs within the signed process and can connect to the product's privileged helper service to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.

The weakness was published by Florian Haselsteiner. The advisory is shared for download at r.sec-consult.com. This vulnerability is handled as CVE-2026-24064 since 01/21/2026. The exploitation is known to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1574.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Waves Audio

Name

• Waves Central

Version

• 16.5.0
• 16.5.1
• 16.5.2
• 16.5.3
• 16.5.4
• 16.5.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion