CVE-2026-24067: Slate Digital Connect Privilege Escalation

CVE-2026-24067 Overview

CVE-2026-24067 is a time-of-check time-of-use (TOCTOU) race condition in Slate Digital Connect 1.37.0 for macOS. The application installs a privileged helper tool named com.slatedigital.connect.privileged.helper.tool that exposes an XPC service. The helper validates connecting XPC clients by retrieving the client's process identifier (PID) and using it to look up code-signing information. Because PIDs can be reused on macOS, a local attacker can race the validation step and have the helper authenticate a trusted process instead of the actual caller. Successful exploitation grants unauthorized access to privileged helper functionality and enables local privilege escalation.

Critical Impact
A local attacker can escalate privileges to root on macOS systems running Slate Digital Connect 1.37.0 by exploiting PID reuse against the privileged helper's XPC client validation.

Affected Products

Slate Digital Connect 1.37.0 for macOS
com.slatedigital.connect.privileged.helper.tool privileged helper component
com.slatedigital.connect.privileged.helper.tool2 XPC service

Discovery Timeline

2026-06-10 - CVE-2026-24067 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-24067

Vulnerability Analysis

Slate Digital Connect installs a privileged helper tool that runs as root and accepts requests over an XPC service. When a client connects, the helper retrieves the client's PID using XPC APIs and then queries code-signing information for that PID to decide whether to authorize the caller. This validation pattern is unsafe on macOS because PIDs are reused after a process exits. The flaw is classified as [CWE-367] Time-of-Check Time-of-Use Race Condition.

A local unprivileged attacker can connect to the XPC service with a process whose PID is later recycled. By forking and exiting processes in a controlled sequence, the attacker can force the helper to evaluate code-signing attributes against an Apple-signed or otherwise trusted binary that now occupies the same PID. The helper then authorizes privileged operations on behalf of the attacker's original, untrusted process.

Root Cause

The root cause is the use of PID-based identification for security decisions. PIDs are not stable identifiers and can be reused immediately after a process exits. The helper should instead use the XPC audit token (xpc_connection_get_audit_token) to obtain a stable, kernel-vouched identity for code-signing checks via SecCodeCopyGuestWithAttributes using the audit token attribute.

Attack Vector

Exploitation requires local access with the ability to execute arbitrary code as an unprivileged user. The attacker opens an XPC connection to com.slatedigital.connect.privileged.helper.tool2 and triggers process churn so the connecting process's PID is reassigned to a trusted binary before the helper performs its code-signing lookup. Once validation succeeds against the substituted trusted process, the attacker invokes privileged helper methods to achieve code execution as root. No user interaction is required.

No public proof-of-concept exploit is currently available. Technical details are documented in the SEC Consult Local Privilege Escalation Advisory and the SEC Consult Slate Overview.

Detection Methods for CVE-2026-24067

Indicators of Compromise

Presence of com.slatedigital.connect.privileged.helper.tool in /Library/PrivilegedHelperTools/ on macOS hosts running version 1.37.0.
Unexpected child processes spawned by the Slate helper running with root privileges.
High-frequency fork/exec activity from an unprivileged process immediately preceding XPC connections to the Slate helper service.

Detection Strategies

Monitor XPC connections to com.slatedigital.connect.privileged.helper.tool2 correlated with rapid process creation and termination from the same user session.
Audit privileged helper executions for parent-child process anomalies where the helper invokes operations on behalf of recently exited PIDs.
Use Endpoint Security framework events (ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_EXIT) to identify PID-reuse patterns near XPC handshakes.

Monitoring Recommendations

Alert on any new file write to /Library/PrivilegedHelperTools/com.slatedigital.connect.privileged.helper.tool.
Track root-level process launches whose initiating user context is non-administrative.
Retain XPC and process telemetry on macOS endpoints for retrospective hunting against TOCTOU exploitation patterns.

How to Mitigate CVE-2026-24067

Immediate Actions Required

Inventory macOS endpoints to identify installations of Slate Digital Connect 1.37.0.
Update Slate Digital Connect to a version released after the vendor addresses the PID validation flaw.
Restrict local user accounts on systems where the application must remain installed.

Patch Information

At the time of publication, consult the SEC Consult Local Privilege Escalation Advisory for the latest vendor patch status. A correct fix replaces PID-based client identification with audit-token-based validation, using xpc_connection_get_audit_token and SecCodeCopyGuestWithAttributes with the kSecGuestAttributeAudit attribute.

Workarounds

Remove the privileged helper by unloading it with launchctl and deleting the binary from /Library/PrivilegedHelperTools/ if the application is not required.
Limit interactive logon on workstations running the affected version to trusted administrators only.
Uninstall Slate Digital Connect entirely on multi-user systems until a fixed release is available.

bash

# Unload and remove the vulnerable privileged helper
sudo launchctl unload /Library/LaunchDaemons/com.slatedigital.connect.privileged.helper.tool.plist
sudo rm /Library/LaunchDaemons/com.slatedigital.connect.privileged.helper.tool.plist
sudo rm /Library/PrivilegedHelperTools/com.slatedigital.connect.privileged.helper.tool