PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24068 Vienna Symphonic Library GmbH CVE debrief

A macOS privileged helper tool (VSL) fails to validate XPC client connections in its `shouldAcceptNewConnection` handler, allowing any process to connect and invoke `writeReceiptFile` and `runUninstaller` endpoints without authorization. These endpoints permit arbitrary file writes and command execution with elevated privileges, resulting in local privilege escalation.

Vendor
Vienna Symphonic Library GmbH
Product
Vienna Assistant
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-26
Original CVE updated
2026-05-19
Advisory published
2026-03-26
Advisory updated
2026-05-19

Who should care

macOS system administrators, endpoint security teams, and developers of privileged helper tools using NSXPC for inter-process communication.

Technical summary

The VSL privileged helper tool on macOS implements an NSXPC listener that fails to validate connecting clients in `shouldAcceptNewConnection`. This allows any process to connect and invoke protocol methods including `writeReceiptFile` and `runUninstaller`, which lack endpoint-level authorization checks. An attacker can leverage this to write arbitrary files to any location and execute arbitrary commands with root privileges. The vulnerability represents a classic privileged helper tool weakness where XPC client authentication is omitted, enabling complete compromise of the endpoint protection boundary.

Defensive priority

HIGH

Recommended defensive actions

  • Audit macOS endpoints for privileged helper tools using NSXPC; verify `shouldAcceptNewConnection` implements proper client validation (code signing, bundle ID, or team identifier checks)
  • Review XPC service protocol implementations to ensure sensitive endpoints require explicit authorization beyond connection acceptance
  • Apply principle of least privilege to helper tool capabilities; restrict file write paths and command execution to predefined allowlists
  • Monitor for anomalous XPC connections to privileged services from unexpected client processes
  • Prioritize patching when vendor advisory becomes available; interim mitigation requires restricting untrusted code execution on affected systems

Evidence notes

The vulnerability description indicates missing client validation in NSXPC `shouldAcceptNewConnection` and unprotected `writeReceiptFile`/`runUninstaller` endpoints. CVSS 8.8 (HIGH) assigned. NVD status is 'Deferred' as of 2026-05-19.

Official resources

2026-03-26