CVE-2026-24071

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24071", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2026-01-21T11:29:19.854Z", "datePublished": "2026-02-02T13:23:51.846Z", "dateUpdated": "2026-02-03T14:42:22.938Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "platforms": ["MacOS"], "product": "Native Access", "vendor": "Native Instruments", "versions": [{"status": "affected", "version": "verified up to 3.22.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Florian Haselsteiner, SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks.&nbsp;The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.<br>"}], "value": "It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks.\u00a0The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks."}], "impacts": [{"capecId": "CAPEC-29", "descriptions": [{"lang": "en", "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-02-02T13:23:51.846Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor was unreachable and did not respond to multiple contact attempts. No patch is available. Customers should contact the vendor and request a patch.</p>"}], "value": "The vendor was unreachable and did not respond to multiple contact attempts. No patch is available. Customers should contact the vendor and request a patch."}], "source": {"discovery": "EXTERNAL"}, "title": "XPC Client Validation via PID leading to Local Privilege Escalation in Native Instruments Native Access", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T17:08:50.317360Z", "id": "CVE-2026-24071", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T14:42:22.938Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24071", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-02T17:08:50.317360Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:01:49.245Z"}}], "cna": {"title": "XPC Client Validation via PID leading to Local Privilege Escalation in Native Instruments Native Access", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Florian Haselsteiner, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-29", "descriptions": [{"lang": "en", "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"}]}], "affected": [{"vendor": "Native Instruments", "product": "Native Access", "versions": [{"status": "affected", "version": "verified up to 3.22.0"}], "platforms": ["MacOS"], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The vendor was unreachable and did not respond to multiple contact attempts. No patch is available. Customers should contact the vendor and request a patch.", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor was unreachable and did not respond to multiple contact attempts. No patch is available. Customers should contact the vendor and request a patch.</p>", "base64": false}]}], "references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks.\u00a0The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.", "supportingMedia": [{"type": "text/html", "value": "It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks.&nbsp;The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2026-02-02T13:23:51.846Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24071", "state": "PUBLISHED", "dateUpdated": "2026-02-03T14:42:22.938Z", "dateReserved": "2026-01-21T11:29:19.854Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2026-02-02T13:23:51.846Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["MacOS"], "product": "Native Access", "vendor": "Native Instruments", "versions": [{"status": "affected", "version": "verified up to 3.22.0"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:native-instruments:native_access:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D0299D5-FF09-4EE2-8F1D-E2FC624D27DB", "versionEndIncluding": "3.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks.\u00a0The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks."}, {"lang": "es", "value": "Se descubri\u00f3 que el servicio XPC ofrecido por el asistente privilegiado de Native Access utiliza el PID del cliente que se conecta para verificar su firma de c\u00f3digo. Esto se considera inseguro y puede ser explotado por ataques de reutilizaci\u00f3n de PID. La funci\u00f3n manejadora de conexi\u00f3n utiliza _xpc_connection_get_pid(arg2) como argumento para la funci\u00f3n hasValidSignature. Este valor no es de confianza ya que es vulnerable a ataques de reutilizaci\u00f3n de PID."}], "id": "CVE-2026-24071", "lastModified": "2026-06-17T10:22:33.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24071", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T17:08:50.317360Z", "version": "2.0.3"}}]}, "published": "2026-02-02T14:16:35.753", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:39:12.093414+00:00", "value": {"mitigation_remediation": ["Contact Native Instruments and request a patch for Native Access.", "If a patch is not available, consider downgrading to a pre\u2011vulnerability version until a fix is released.", "Limit the privileges of users who can run Native Access and monitor the system for suspicious PID reuse activity."], "summary": {"action": "Contact Vendor", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Native Instruments Native Access, all released versions are affected.", "description_and_impact": "The vulnerable XPC service in Native Access verifies the code signature of connecting clients by using the PID supplied by the operating system. Because process identifiers are reused, an attacker can trick the privileged helper into accepting a malicious process as a legitimate client, allowing local privilege escalation. This flaw is an instance of improper validation of a resource ownership setting, specifically CWE\u2011367.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score is reported as less than 1\u202f%, implying a low probability of exploitation, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to run a malicious process on the same machine to abuse the PID\u2011reuse flaw. No public exploits are known, but the flaw can be leveraged by an attacker who gains local execution capability to obtain elevated privileges on the host."}}}}, "created": "2026-02-04T12:44:35.333925+00:00", "updated": "2026-04-18T00:45:32.240545+00:00", "vendors": ["native_instruments", "native_instruments$PRODUCT$native_access"]}