Waves Audio Waves Central up to 16.5.5 Helper Service toctou

Summaryinfo

A vulnerability was found in Waves Audio Waves Central up to 16.5.5. It has been declared as critical. This affects an unknown function of the component Helper Service. The manipulation results in toctou. This vulnerability is cataloged as CVE-2026-24065. The attack must be initiated from a local position. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Waves Audio Waves Central up to 16.5.5. It has been classified as critical. Affected is some unknown processing of the component Helper Service. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and the time the helper performs validation, causing the helper to trust an attacker-controlled process. This allows the attacker to invoke privileged operations, resulting in arbitrary code execution as root. The issue is fixed in version 16.6.2.

The weakness was shared by Florian Haselsteiner. The advisory is shared for download at r.sec-consult.com. This vulnerability is traded as CVE-2026-24065 since 01/21/2026. The exploitability is told to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 16.6.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Waves Audio

Name

• Waves Central

Version

• 16.5.0
• 16.5.1
• 16.5.2
• 16.5.3
• 16.5.4
• 16.5.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion