{"affected":[{"defaultStatus":"unaffected","platforms":["MacOS"],"product":"Slate Digital Connect","source":"CNA: SEC-VLab","vendor":"Slate Digital LLC","versions":[{"lessThan":"2.11.0","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-24067","cwes":["CWE-367"],"description":"Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.","epss":{"date":"2026-11-05","percentile":0.07706,"score":0.00181},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-in-slate-digital-connect/"}],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793958955177,"publishedAt":1781092150839,"references":[{"source":"CNA: SEC-VLab","tags":["third-party-advisory"],"url":"https://r.sec-consult.com/slate"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-in-slate-digital-connect/"}],"remediation":[{"kind":"fix","source":"CNA: SEC-VLab","text":"The vendor did not respond to the disclosure attempts, and no fixed version was available at the time of publication.\n\nUpdate 2026-11-06:\n\n\n\nThe vendor informs that v2.11.0 fixes the issue since 7th July 2026 now. Furthermore, the app name has changed and is now called Complete Access Hub since v2.0.0."}],"revision":"d34a516edbd32ce8a906fefe5da514f93c68dc5a6ce326996e16689c2bcbdea4","sources":[{"modifiedAt":1793958955177,"name":"CNA: SEC-VLab","retrievedAt":1793959722800,"url":"https://www.cve.org/CVERecord?id=CVE-2026-24067"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793959725950,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-24067"}],"ssvc":{"assessedAt":1781101363985,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Slate Digital Connect macOS XPC PID validation privilege escalation","updatedAt":1793959725950}