CVE-2024-14032 — Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root …
Published: 2026-04-06 · CVSS: 8.5 · CVSS 4.0
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7