{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-24062","assignerOrgId":"551230f0-3615-47bd-b7cc-93e92e730bbf","state":"PUBLISHED","assignerShortName":"SEC-VLab","dateReserved":"2026-01-21T11:29:19.852Z","datePublished":"2026-03-18T15:24:07.985Z","dateUpdated":"2026-03-18T15:55:32.532Z"},"containers":{"cna":{"providerMetadata":{"orgId":"551230f0-3615-47bd-b7cc-93e92e730bbf","shortName":"SEC-VLab","dateUpdated":"2026-03-18T15:24:07.985Z"},"title":"Insufficient XPC Client validation leading to local privilege escalation in Arturia Software Center","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-306","description":"CWE-306 Missing authentication for critical function","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-1","descriptions":[{"lang":"en","value":"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}],"affected":[{"vendor":"Arturia","product":"Software Center","platforms":["MacOS"],"versions":[{"status":"affected","version":"2.12.0.3157"}],"defaultStatus":"unknown"}],"descriptions":[{"lang":"en","value":"The \"Privileged Helper\" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. This leads to an attacker being able to connect to the helper and execute privileged actions leading to local privilege escalation.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>The \"Privileged Helper\" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects.&nbsp;<span>This leads to an attacker being able to connect to the helper and execute privileged actions leading to local privilege escalation.</span></p><br>"}]}],"references":[{"url":"https://r.sec-consult.com/arturia","tags":["third-party-advisory"]}],"solutions":[{"lang":"en","value":"The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.</p>"}]}],"credits":[{"lang":"en","value":"Florian Haselsteiner, SEC Consult Vulnerability Lab","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-03-18T15:55:13.330338Z","id":"CVE-2026-24062","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-18T15:55:32.532Z"}}]}}