CVE-2026-24066/24067: Local Privilege Escalation in Slate Digital Connect (macOS) with POC

Vulnerability Overview Vulnerability Name: Local Privilege Escalation in Slate Digital Connect (macOS) CVE IDs: CVE-2026-24066, CVE-2026-24067 Affected Versions: Slate Digital Connect (macOS) 1.37.0 Fixed Versions: None Disclosure Date: September 1, 2026 Vulnerability Description: - CVE-2026-24066: Local privilege escalation achieved through insufficient XPC client validation. An attacker can leverage privileged helper tools to gain root access. - CVE-2026-24067: Local privilege escalation via insecure XPC client validation based on PID. Attackers can exploit PID reuse vulnerabilities to escalate privileges. Impact Scope Affected Product: Slate Digital Connect (macOS) 1.37.0 Severity: High Business Advice: Users should contact vendor support and request a patch. SEC Consult recommends conducting a thorough security review to identify and remediate potential security issues. Remediation Current Status: The vendor has been unresponsive since January 2026; no patch is currently available. Recommended Measures: Users should contact vendor support and request a patch. SEC Consult recommends conducting a thorough security review to identify and remediate potential security issues. Proof of Concept (POC) Code CVE-2026-24066 CVE-2026-24067 Vendor Contact Timeline 2026-01-21: Contacted the vendor via their support website. 2026-02-02: Contacted the vendor via email; no response received. 2026-02-24: Contacted the vendor again via their support website; no response received. 2026-04-07: Contacted the vendor via their help center; no response received. 2026-04-28: Attempted to contact the vendor via their privacy email; message was rejected. 2026-04-28: Contacted info@audiotonix.com; no response received. 2026-06-10: Published security advisory. Resolution Current Status: The vendor has been unresponsive since January 2026; no patch is currently available. Recommended Measures: Users should contact vendor support and request a patch. SEC Consult recommends conducting a thorough security review to identify and remediate potential security issues. Workspace Current Status: No workspace available. Advisory URL Link: https://sec-consult.com/vulnerability-lab/ Authors Author: Florian Haselsteiner (Office Vienna) Organization: SEC Consult Vulnerability Lab Date: 2026 --- EOF Florian Haselsteiner / @2026

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-24066/24067: Local Privilege Escalation in Slate Digital Connect (macOS) with POC