CVE-2026-24071

Description

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.

PUBLISHED Reserved 2026-01-21 | Published 2026-02-02 | Updated 2026-02-03 | Assigner SEC-VLab

Problem types

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Product status

Credits

Florian Haselsteiner, SEC Consult Vulnerability Lab finder

References

sec-consult.com/...n-native-instruments-native-access-macos/ third-party-advisory

cve.org (CVE-2026-24071)

nvd.nist.gov (CVE-2026-24071)

Download JSON