CVE-2026-24068

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24068", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2026-01-21T11:29:19.853Z", "datePublished": "2026-03-26T10:55:54.603Z", "dateUpdated": "2026-04-03T05:33:07.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-03-26T10:55:54.603Z"}, "title": "Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Vienna Symphonic Library GmbH", "product": "Vienna Assistant", "platforms": ["MacOS"], "versions": [{"status": "affected", "version": "1.2.542"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The VSL privileged helper does utilize NSXPC for IPC. The implementation of the \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all.\u00a0This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol.\u00a0No validation is performed in the functions \"writeReceiptFile\" and \u201crunUninstaller\u201d of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The VSL privileged helper does utilize NSXPC for IPC. The implementation of the \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all.&nbsp;<span>This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol.&nbsp;</span><span>No validation is performed in the functions \"writeReceiptFile\" and \u201crunUninstaller\u201d of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.</span></p>"}]}], "references": [{"url": "https://r.sec-consult.com/vsl", "tags": ["third-party-advisory"]}], "solutions": [{"lang": "en", "value": "The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.</p>"}]}], "credits": [{"lang": "en", "value": "Florian Haselsteiner, SEC Consult Vulnerability Lab", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T13:51:15.411589Z", "id": "CVE-2026-24068", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T13:51:53.385Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2026/Apr/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-03T05:33:07.150Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2026/Apr/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-03T05:33:07.150Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24068", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T13:51:15.411589Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T13:50:04.333Z"}}], "cna": {"title": "Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Florian Haselsteiner, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Vienna Symphonic Library GmbH", "product": "Vienna Assistant", "versions": [{"status": "affected", "version": "1.2.542"}], "platforms": ["MacOS"], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor was unresponsive and did not respond to any of our communication attempts. Therefore, a patch is not available. In case you are using this product, please approach the vendor and demand a fix.</p>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/vsl", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "The VSL privileged helper does utilize NSXPC for IPC. The implementation of the \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all.\u00a0This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol.\u00a0No validation is performed in the functions \"writeReceiptFile\" and \u201crunUninstaller\u201d of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.", "supportingMedia": [{"type": "text/html", "value": "<p>The VSL privileged helper does utilize NSXPC for IPC. The implementation of the \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all.&nbsp;<span>This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol.&nbsp;</span><span>No validation is performed in the functions \"writeReceiptFile\" and \u201crunUninstaller\u201d of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-03-26T10:55:54.603Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24068", "state": "PUBLISHED", "dateUpdated": "2026-04-03T05:33:07.150Z", "dateReserved": "2026-01-21T11:29:19.853Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2026-03-26T10:55:54.603Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["MacOS"], "product": "Vienna Assistant", "vendor": "Vienna Symphonic Library GmbH", "versions": [{"status": "affected", "version": "1.2.542"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VSL privileged helper does utilize NSXPC for IPC. The implementation of the \"shouldAcceptNewConnection\" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all.\u00a0This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol.\u00a0No validation is performed in the functions \"writeReceiptFile\" and \u201crunUninstaller\u201d of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation."}, {"lang": "es", "value": "El asistente privilegiado de VSL utiliza NSXPC para IPC. La implementaci\u00f3n de la funci\u00f3n 'shouldAcceptNewConnection', que es utilizada por el framework NSXPC para validar si a un cliente se le debe permitir conectarse al oyente XPC, no valida a los clientes en absoluto. Esto significa que cualquier proceso puede conectarse a este servicio utilizando el protocolo configurado. Un proceso malicioso puede llamar a todas las funciones definidas en el HelperToolProtocol correspondiente. No se realiza ninguna validaci\u00f3n en las funciones 'writeReceiptFile' y 'runUninstaller' del HelperToolProtocol. Esto permite a un atacante escribir archivos en cualquier ubicaci\u00f3n con cualquier dato, as\u00ed como ejecutar cualquier archivo con cualquier argumento. Cualquier proceso puede llamar a estas funciones debido a la falta de validaci\u00f3n del cliente XPC descrita anteriormente. El abuso de la falta de validaci\u00f3n del endpoint conduce a la escalada de privilegios."}], "id": "CVE-2026-24068", "lastModified": "2026-06-17T10:22:33.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24068", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T13:51:15.411589Z", "version": "2.0.3"}}]}, "published": "2026-03-26T11:16:20.097", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/vsl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2026/Apr/3"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["macos"], "status": "affected", "versions": {"scheme": "semver", "value": "1.2.542"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Vienna Assistant", "source": "cna", "vendor": "Vienna Symphonic Library GmbH"}, "product": "vienna_assistant", "vendor": "vienna_symphonic_library"}], "analysis": {"en": {"generated_at": "2026-03-26T15:34:03.621003+00:00", "value": {"mitigation_remediation": ["Reach out to Vienna Symphonic Library and demand an urgent patch or mitigation guidance", "If the application is non\u2011critical, uninstall Vienna Assistant or disable its helper service", "Restrict local execution rights to prevent untrusted processes from creating XPC connections to Vienna Assistant", "Monitor system logs for unexpected XPC activity or unauthorized file write attempts"], "summary": {"action": "Demand Fix", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "This flaw affects Vienna Symphonic Library GmbH's Vienna Assistant software. No specific version information is provided in the CNA data, so any installation of Vienna Assistant that includes the VSL privileged helper is potentially vulnerable.", "description_and_impact": "The vulnerability lies in the VSL privileged helper's use of NSXPC for interprocess communication. The helper's function that should validate new connections does not perform any verification, which allows any local process to establish a connection to its XPC service. Once connected, an attacker gains access to the HelperToolProtocol, including the unprotected functions 'writeReceiptFile' and 'runUninstaller'. These functions permit arbitrary file writes with any data and arbitrary command execution, respectively, enabling a local attacker to modify critical system files or execute programs with elevated privileges. The absence of validation results in a clear privilege escalation path without requiring exploitation of additional weaknesses.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, supporting the low exploit likelihood assessment. The likely attack vector is local: any process running on the same machine can connect to the vulnerable XPC endpoint. Given the lack of client validation and the powerful operations exposed by the helper, a local attacker can achieve full privilege escalation with minimal prerequisites."}}}}, "created": "2026-03-26T13:54:52.785557+00:00", "updated": "2026-03-27T09:28:46.585075+00:00", "vendors": ["vienna_symphonic_library", "vienna_symphonic_library$PRODUCT$vienna_assistant"]}