CVE-2026-24063

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24063", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2026-01-21T11:29:19.853Z", "datePublished": "2026-03-18T15:33:35.010Z", "dateUpdated": "2026-03-18T15:52:07.784Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-03-18T15:33:35.010Z"}, "title": "World-writable uninstall script executed as root in Arturia Software Center", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-276", "description": "CWE-276 Incorrect default permissions", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Arturia", "product": "Software Center", "platforms": ["MacOS"], "versions": [{"status": "affected", "version": "2.12.0.3157"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.</p>"}]}], "references": [{"url": "https://r.sec-consult.com/arturia", "tags": ["third-party-advisory"]}], "solutions": [{"lang": "en", "value": "The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.</p>"}]}], "credits": [{"lang": "en", "value": "Florian Haselsteiner, SEC Consult Vulnerability Lab", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T15:51:40.300551Z", "id": "CVE-2026-24063", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T15:52:07.784Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24063", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-18T15:51:40.300551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T15:50:44.234Z"}}], "cna": {"title": "World-writable uninstall script executed as root in Arturia Software Center", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Florian Haselsteiner, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "Arturia", "product": "Software Center", "versions": [{"status": "affected", "version": "2.12.0.3157"}], "platforms": ["MacOS"], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.</p>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/arturia", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.", "supportingMedia": [{"type": "text/html", "value": "<p>When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect default permissions"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-03-18T15:33:35.010Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24063", "state": "PUBLISHED", "dateUpdated": "2026-03-18T15:52:07.784Z", "dateReserved": "2026-01-21T11:29:19.853Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2026-03-18T15:33:35.010Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["MacOS"], "product": "Software Center", "vendor": "Arturia", "versions": [{"status": "affected", "version": "2.12.0.3157"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation."}, {"lang": "es", "value": "Cuando se instala un plugin usando el Arturia Software Center (macOS), tambi\u00e9n instala un script bash uninstall.sh en una ruta propiedad de root. Este script se escribe en el disco con los permisos de archivo 777, lo que significa que es escribible por cualquier usuario. Al desinstalar un plugin a trav\u00e9s del Arturia Software Center, el Privileged Helper recibe instrucciones para ejecutar este script. Cuando el script bash es manipulado por un atacante, este escenario conducir\u00e1 a una escalada de privilegios."}], "id": "CVE-2026-24063", "lastModified": "2026-06-17T10:22:32.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24063", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T15:51:40.300551Z", "version": "2.0.3"}}]}, "published": "2026-03-18T16:16:26.527", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/arturia"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["macos"], "status": "affected", "versions": {"scheme": "generic", "value": "2.12.0.3157"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Software Center", "source": "cna", "vendor": "Arturia"}, "product": "software_center", "vendor": "arturia"}], "analysis": {"en": {"generated_at": "2026-03-18T17:20:39.199177+00:00", "value": {"mitigation_remediation": ["Approach Arturia and demand a fix as the vendor has not released a patch, according to the vendor's own statement.", "If practical, inspect the uninstall.sh script and change its permissions to a secure mode (e.g., 700 or 750) to prevent unwarranted modifications, ensuring only the owner can edit it.", "Continuously monitor the file and system logs for any unauthorized changes to the uninstall script, and consider disabling the privileged helper or uninstalling the product if the vulnerability cannot be mitigated promptly."], "summary": {"action": "Demand Fix", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Arturia Software Center on macOS is affected. All installations that use the uninstall script are susceptible; no specific version ranges are provided, implying that the flaw is present across the current product stock.", "description_and_impact": "The vulnerability involves a world\u2011writable uninstall script (uninstall.sh) that is created with 777 permissions and located in a root\u2011owned path. When Arturia Software Center\u2019s privileged helper executes this script during plugin uninstallation, an attacker who can modify the file gains the ability to run arbitrary commands as root. This constitutes a privilege escalation scenario, compromising system integrity and confidentiality, with the potential for full system compromise. The weakness is categorised under CWE\u2011276, File or Directory Permissions Weakness.", "risk_and_exploitability": "The CVSS score of 8.2 indicates high severity, and although an EPSS score is missing, the lack of a known public exploit and absence from KEV suggest limited early exploitation but a potentially significant risk to any system where an attacker can obtain local write access. Exploitation requires local access to the file system to alter uninstall.sh; once modified, the privileged helper executes the script with root privileges, enabling any further malicious activity."}}}}, "created": "2026-03-19T08:56:27.445049+00:00", "updated": "2026-03-24T10:58:34.291443+00:00", "vendors": ["arturia", "arturia$PRODUCT$software_center"]}