CVE-2026-24067

{
  "id": "CVE-2026-24067",
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "published": "2026-06-10T12:16:25.340",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation."
    },
    {
      "lang": "es",
      "value": "Slate Digital Connect 1.37.0 para macOS instala una herramienta de ayuda privilegiada, com.slatedigital.connect.privileged.helper.tool, que expone el servicio XPC com.slatedigital.connect.privileged.helper.tool2. La herramienta de ayuda valida los clientes XPC que se conectan obteniendo el identificador de proceso del cliente y usándolo para recuperar información de firma de código para el proceso. Esta validación de cliente basada en PID está sujeta a una condición de carrera de tiempo de verificación y tiempo de uso porque los identificadores de proceso pueden ser reutilizados. Un atacante local puede explotar la reutilización de PID de modo que la validación se realice contra un proceso de confianza en lugar del proceso de conexión original. Esto permite el acceso no autorizado a la funcionalidad de la herramienta de ayuda privilegiada y puede conducir a una escalada de privilegios local."
    }
  ],
  "affected": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "affectedData": [
        {
          "vendor": "Slate Digital LLC",
          "product": "Slate Digital Connect",
          "defaultStatus": "unknown",
          "platforms": [
            "MacOS"
          ],
          "versions": [
            {
              "version": "1.37.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-10T14:22:43.985081Z",
          "id": "CVE-2026-24067",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://r.sec-consult.com/slate",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    },
    {
      "url": "https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-in-slate-digital-connect/",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}