CVE-2026-24064 Overview
CVE-2026-24064 is a local privilege escalation vulnerability in Waves Central for macOS versions 13.0.9 through 16.5.5. The flaw allows a local attacker to inject an arbitrary dynamic library into a trusted XPC client process signed with permissive hardened runtime entitlements. Once loaded, the injected code executes inside the signed process and communicates with the product's privileged helper service to invoke root-level operations. Waves resolved the issue in version 16.6.2. The vulnerability is tracked under [CWE-426] Untrusted Search Path.
Critical Impact
A local user can achieve arbitrary code execution as root on macOS systems running affected Waves Central versions.
Affected Products
- Waves Central for macOS 13.0.9 through 16.5.5
- Bundled trusted XPC client component signed with dynamic library injection entitlements
- Associated privileged helper service installed with Waves Central
Discovery Timeline
- 2026-06-09 - CVE-2026-24064 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-24064
Vulnerability Analysis
Waves Central ships an XPC client binary signed with hardened runtime entitlements that explicitly allow dynamic library injection. On macOS, hardened runtime normally blocks DYLD_INSERT_LIBRARIES and unsigned library loading. When a vendor enables entitlements such as com.apple.security.cs.allow-dyld-environment-variables or com.apple.security.cs.disable-library-validation, those protections are removed for that specific binary.
A local attacker leverages this configuration to load attacker-controlled code inside a signed, trusted process. The injected library inherits the process identity and any IPC trust relationships granted to that binary. In this case, the trusted XPC client is permitted to call the Waves privileged helper installed as a SMJobBless LaunchDaemon running as root.
Root Cause
The root cause is overly permissive code-signing entitlements combined with weak client validation in the privileged helper. The helper authenticates callers based on code signature and bundle identity rather than verifying the integrity of the loaded image. Because the injected dylib runs inside a signed process matching the helper's allowlist, privileged operations are exposed to attacker code.
Attack Vector
Exploitation requires local access and the ability to set environment variables for a process launch. An attacker writes a malicious dynamic library to a writable location, exports DYLD_INSERT_LIBRARIES pointing to the library, and launches the trusted Waves XPC client binary. The library's constructor executes inside the signed process, opens an XPC connection to the privileged helper, and invokes file-write or command-execution methods exposed by the helper interface. Those operations run as root, yielding full system compromise from an unprivileged user account. See the SEC Consult Security Report for technical details.
Detection Methods for CVE-2026-24064
Indicators of Compromise
- Process launches of Waves Central XPC client binaries with DYLD_INSERT_LIBRARIES set in the environment
- Unexpected dynamic libraries loaded from user-writable paths into Waves-signed processes
- XPC connections to the Waves privileged helper originating from anomalous parent processes such as bash, zsh, or Terminal
- Root-owned files or LaunchDaemons created shortly after a Waves Central process spawn
Detection Strategies
- Monitor posix_spawn and execve events for Waves binaries and capture their environment variables
- Audit loaded image events for Waves processes and alert on dylibs outside the application bundle
- Correlate Waves helper service invocations with non-GUI parent processes to surface scripted abuse
Monitoring Recommendations
- Enable macOS Endpoint Security framework telemetry for ES_EVENT_TYPE_NOTIFY_EXEC and ES_EVENT_TYPE_NOTIFY_MMAP on the Waves binary set
- Track installations and version strings of Waves Central across managed Macs to identify hosts below 16.6.2
- Alert on writes to /Library/PrivilegedHelperTools/ and /Library/LaunchDaemons/ performed via Waves helper IPC
How to Mitigate CVE-2026-24064
Immediate Actions Required
- Upgrade Waves Central to version 16.6.2 or later on every macOS endpoint
- Inventory all hosts running affected versions 13.0.9 through 16.5.5 and prioritize multi-user systems
- Restrict interactive logins on systems where Waves Central is installed until the patch is deployed
Patch Information
Waves addressed the vulnerability in Waves Central version 16.6.2. The fix removes the dynamic library injection entitlement from the trusted XPC client and tightens caller validation in the privileged helper service. Refer to the SEC Consult Security Report for advisory details.
Workarounds
- Remove Waves Central from systems that do not require it until upgrade to 16.6.2 is possible
- Limit access to systems with vulnerable installations to trusted administrative users only
- Block execution of the vulnerable Waves XPC client binaries through application control policies where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
