CVE-2026-86819 — Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signi…
Published: 2026-09-08 · CVSS: 8.4 · CVSS 4.0
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7