CVE-2026-24065: Waves Central macOS Privilege Escalation

CVE-2026-24065 Overview

CVE-2026-24065 is a local privilege escalation vulnerability in Waves Central for macOS, affecting versions 13.0.9 through 16.5.5. The flaw resides in the application's privileged helper service, which validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because PIDs can be reused on macOS, a local attacker can exploit a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] between the connection request and the helper's validation step. Successful exploitation causes the helper to trust an attacker-controlled process, enabling arbitrary code execution as root. Waves Audio resolved the issue in version 16.6.2.

Critical Impact
A local unprivileged attacker can escalate to root on macOS systems running vulnerable Waves Central versions, leading to full system compromise.

Affected Products

Waves Central for macOS version 13.0.9 and later
Waves Central for macOS versions through 16.5.5
Fixed in Waves Central version 16.6.2

Discovery Timeline

2026-06-09 - CVE-2026-24065 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-24065

Vulnerability Analysis

Waves Central installs a privileged helper service that performs system-level operations on behalf of the user-mode application. The helper exposes an XPC interface that accepts connections from client processes. To restrict access, the helper inspects the connecting client's code-signing identity before honoring privileged requests.

The validation logic identifies the client by its PID and then resolves that PID to a binary path or audit token to evaluate its signature. On macOS, PIDs are not unique over time and can be recycled by the kernel once a process exits. An attacker who connects, then terminates, and then spawns a trusted binary that reuses the same PID can cause the helper to validate the wrong process. The helper grants privileged operations to the attacker's original connection.

Because the helper runs as root, any privileged operation it exposes — file writes, installer invocations, or command execution — becomes a code execution primitive for the unprivileged caller.

Root Cause

The root cause is an unsafe identity check pattern classified under [CWE-367]: Time-of-Check Time-of-Use Race Condition. The helper checks one piece of state (the process behind a PID) and later acts on a different piece of state (the XPC client connection) without atomically binding them. macOS provides audit_token_t-based APIs such as SecCodeCopyGuestWithAttributes that allow direct validation of the connecting client without PID lookup, but the helper does not use them.

Attack Vector

Exploitation requires local code execution as an unprivileged user on a macOS host with a vulnerable Waves Central installation. The attacker opens an XPC connection to the privileged helper, then races a legitimate Waves-signed binary into the same PID slot before the helper completes validation. Once the helper accepts the connection, the attacker invokes exposed privileged methods to execute code or write files as root. No user interaction is required beyond the attacker's own process activity.

For a full technical breakdown, see the SEC Consult Local Privilege Escalation Advisory and the SEC Consult Waves Analysis.

Detection Methods for CVE-2026-24065

Indicators of Compromise

Unexpected child processes spawned by the Waves Central privileged helper running with root privileges.
New or modified files in system-protected locations such as /Library/LaunchDaemons/ or /usr/local/ shortly after Waves Central XPC activity.
Repeated short-lived processes from a single unprivileged user attempting to manipulate PID assignment.

Detection Strategies

Monitor XPC connections to the Waves Central helper service and correlate the connecting PID with the binary actually executing privileged actions.
Alert on writes to privileged file system locations originating from the Waves helper but triggered by non-Waves user processes.
Hunt for process trees where an unprivileged user process is followed by privileged file or process creation under the helper's identity.

Monitoring Recommendations

Enable macOS Endpoint Security telemetry for process exec, fork, and exit events to reconstruct PID reuse sequences.
Centralize endpoint logs and inspect helper activity correlated with rapid process churn by the same user.
Track installed Waves Central versions across the macOS fleet and flag any host below version 16.6.2.

How to Mitigate CVE-2026-24065

Immediate Actions Required

Upgrade Waves Central to version 16.6.2 or later on all macOS endpoints.
Inventory macOS systems for vulnerable Waves Central versions between 13.0.9 and 16.5.5 and prioritize patching.
Restrict local interactive and SSH access on systems where Waves Central is installed until patched.

Patch Information

Waves Audio fixed the vulnerability in Waves Central version 16.6.2. The fix replaces PID-based XPC client validation with audit-token-based code signature validation, eliminating the TOCTOU window. Refer to the SEC Consult Local Privilege Escalation Advisory for vendor coordination details.

Workarounds

Uninstall Waves Central from macOS systems where the application is not actively required.
Remove the privileged helper LaunchDaemon associated with Waves Central if the application cannot be immediately updated.
Limit local user accounts on hosts running vulnerable Waves Central versions to trusted operators only.

bash

# Check installed Waves Central version on macOS
mdls -name kMDItemVersion "/Applications/Waves Central.app"

# List the Waves privileged helper LaunchDaemon if present
sudo launchctl list | grep -i waves

# Remove the privileged helper as a temporary mitigation (requires reinstall to restore functionality)
sudo launchctl unload /Library/LaunchDaemons/com.waves.*.plist
sudo rm /Library/LaunchDaemons/com.waves.*.plist
sudo rm /Library/PrivilegedHelperTools/com.waves.*