CVE-2026-24066— Slate Digital Connect macOS XPC certificate validation privilege escalation
Possible ATT&CK Techniques 2AI
T1548 · Abuse Elevation Control Mechanism T1548.002 · Bypass User Account ControlAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Slate Digital LLC | Slate Digital Connect | 1.37.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-24066
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Slate Digital Connect macOS XPC certificate validation privilege escalation
Source: CVE Program / CVE List V5
Vulnerability Description
Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing authority. A local attacker can sign a malicious client with a self-signed certificate containing the expected organizational unit value and connect to the privileged XPC service. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书信任链回溯不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Slate Digital Connect 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Slate Digital Connect是Slate Digital公司的一款音频插件管理与授权客户端。 Slate Digital Connect 1.37.0版本存在安全漏洞，该漏洞源于XPC服务仅通过客户端签名证书的subject.OU值验证客户端且未验证证书链是否受信任，可能导致本地攻击者使用自签名证书连接特权XPC服务，导致本地权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Slate Digital LLC | Slate Digital Connect | 1.37.0 | - |
II. Public POCs for CVE-2026-24066
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-24066
请登录查看更多情报信息。
News Coverage for CVE-2026-24066 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-24066
No comments yet