gsscred-move-uaf

GSSCred-move-uaf com.apple.GSSCred XPC 服务（在 macOS 和 iOS 上以 root 权限运行）未正确实现 "move" 命令，导致 doMove 函数中出现释放后使用（use-after-free）条件。在 iOS 上，可从默认应用程序沙箱内部访问 GSSCred 服务。 该程序利用此漏洞以崩溃 GSSCred 服务。在 GSSCred 中实现代码执行的关键在于竞争窗口内用受控数据覆盖已释放的内存。已在 macOS High Sierra 10.13.2 Beta 17C79a 上测试。 漏洞分析 以下是 doMove 中的相关部分（来自...

CVE-2026-11318

CVE-2026-11318: Escalada de privilegios local en el cliente DeskIn para macOS Proveedor: DeskIn Producto: Cliente DeskIn para macOS Versiones afectadas: = v3.3.4.3 Descripción general Se ha identificado una vulnerabilidad de escalada de privilegios local LPE en el cliente DeskIn para macOS. Esta...

CVE-2024-11467

CVE-2024-11467 macOS 操作系统使用 XPC 服务实现各种进程之间的基本进程间通信，例如 XPC Service 守护进程与第三方应用程序的特权辅助工具之间的通信。VMware Horizon Client 在安装时会在 /Library/PrivilegedHelperTools/ 目录下注册 com.vmware.horizon.CDSHelper 特权辅助工具。 还应注意，特权辅助工具使用 mach 名称 com.vmware.horizon.CDSHelper 来监听传入的 XPC 连接，如上所示。 随后使用默认的 macOS...

CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666 – Ataque de deserialización NSKeyedUnarchiver en el servicio XPC simulación macOS/iOS Código del programa simulación en Python !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct...

ios-nehelper-enum-apps-0day

nehelper enumerar aplicaciones instaladas 0-day iOS 15.0 He actualizado este código para evitar usar la API privada directamente. Lea más en mi publicación de blog. Sin embargo, eso significa que ahora este código es específico de la versión de iOS y posiblemente específico del modelo de...

Exploit for NULL Pointer Dereference in Pgbouncer

--- CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserializ...

CVE-2026-12374

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-12374 Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-12374

CVE-2026-12374 affects the macOS PrivilegedHelperTool in Cato Client prior to v5.13.1. The issue combines improper XPC caller certificate validation with a TOCTOU race, allowing a local authenticated attacker to escalate to root by using a self-signed certificate that bypasses XPC caller verifica...

EUVD-2026-41001

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-12374: Improper Certificate Validation

Improper certificate validation and a time-of-check time-of-use TOCTOU race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller...

CVE-2026-24067

Slate Digital Connect version 1.37.0 for macOS is vulnerable to local privilege escalation due to a time-of-check time-of-use (TOCTOU) race condition. The issue exists within the privileged helper tool com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital...

CVE-2026-24067 Slate Digital Connect macOS XPC PID validation privilege escalation

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and...

CVE-2026-24066

Slate Digital Connect version 1.37.0 for macOS contains a local privilege escalation vulnerability. The software installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The vulnerability ex...

EUVD-2026-36002

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the...

PT-2026-48401

Name of the Vulnerable Software and Affected Versions Slate Digital Connect version 1.37.0 Description The software installs a privileged helper tool, 'com.slatedigital.connect.privileged.helper.tool', which exposes the XPC service 'com.slatedigital.connect.privileged.helper.tool2'. The helper...

PT-2026-48400

Name of the Vulnerable Software and Affected Versions Slate Digital Connect version 1.37.0 Description The software installs a privileged helper tool, 'com.slatedigital.connect.privileged.helper.tool', which exposes the XPC service 'com.slatedigital.connect.privileged.helper.tool2'. The helper...

CVE-2026-24066: Improper Following of a Certificate's Chain of Trust

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the...

Slate Digital Connect 安全漏洞

Slate Digital Connect is an audio plugin management and licensing client developed by Slate Digital. Version 1.37.0 of Slate Digital Connect contains a security vulnerability. This vulnerability stems from the XPC service verifying the client only based on the subject.OU value of the client’s...

CVE-2024-14032

Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite...