Slate Digital Connect 1.37.0 XPC Service subject.OU improper following of a certificate's chain of trust

Summaryinfo

A vulnerability categorized as problematic has been discovered in Slate Digital Connect 1.37.0. Affected by this issue is some unknown functionality of the component XPC Service. The manipulation of the argument subject.OU results in improper following of a certificate's chain of trust. This vulnerability is known as CVE-2026-24066. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability was found in Slate Digital Connect 1.37.0. It has been classified as problematic. Affected is an unknown functionality of the component XPC Service. The manipulation of the argument subject.OU with an unknown input leads to a improper following of a certificate's chain of trust vulnerability. CWE is classifying the issue as CWE-296. The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing authority. A local attacker can sign a malicious client with a self-signed certificate containing the expected organizational unit value and connect to the privileged XPC service. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.

The weakness was published by Florian Haselsteiner. The advisory is shared for download at r.sec-consult.com. This vulnerability is traded as CVE-2026-24066 since 01/21/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1557.003.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36002). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Slate Digital

Name

• Connect

Version

• 1.37.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion