Is CVE-2026-24064 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24064 being exploited in the wild.

How severe is CVE-2026-24064?

Informational severity, with a CVSS score of 7.8, published 9 June 2026.

Which products and versions are affected?

Waves Audio Waves Central 13.0.9 - 16.5.5.

Is there a fix for CVE-2026-24064?

A patch was published on 2026-06-09: Fixed in version 16.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24064 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-24064?

Check whether you run Waves Audio Waves Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24064: Waves Audio Waves Central privilege escalation via dylib injection

CVE-2026-24064 · Severity: info · CVSS 7.8 · Published 2026-06-09

Waves Central, a management application for professional audio plugins, contains a security flaw on macOS that allows a local user to gain administrative (root) control of the computer. By exploiting improper security settings in a helper component, an attacker can inject malicious code into a trusted process and trick the system into performing high-privilege tasks. This could lead to full system compromise, unauthorized data access, or the installation of persistent malware.

Technologies: Waves Audio Waves Central. Vendors: Waves Audio.

Quick answers

Is CVE-2026-24064 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24064 being exploited in the wild.
How severe is CVE-2026-24064?: Informational severity, with a CVSS score of 7.8, published 9 June 2026.
Which products and versions are affected?: Waves Audio Waves Central 13.0.9 - 16.5.5.
Is there a fix for CVE-2026-24064?: A patch was published on 2026-06-09: Fixed in version 16.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24064 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-24064?: Check whether you run Waves Audio Waves Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Waves Central for macOS (v13.0.9 - 16.5.5) includes a trusted XPC client component, 'InstlHelperApplication', signed with 'com.apple.security.cs.allow-dyld-environment-variables' and 'com.apple.security.cs.disable-library-validation' entitlements. These hardened runtime exceptions allow a local attacker to use the DYLD_INSERT_LIBRARIES environment variable to inject an unsigned, malicious dynamic library into the process. Because the injected code runs within a process possessing a valid Developer ID signature, it can successfully bypass client validation checks when connecting to the 'com.waves.central.InstlHelper' privileged Mach service. An attacker can then invoke privileged methods, such as 'executeIrlFileWithPath', to execute arbitrary commands with root privileges. The vulnerability is resolved in version 16.6.2.

Affected products

Waves Audio Waves Central 13.0.9 - 16.5.5

Timeline

2026-01-07: disclosed: Vulnerability discovered by SEC Consult
2026-06-09: advisory: Public advisory and CVE assignment
2026-06-09: patched: Fixed in version 16.6.2

References

https://r.sec-consult.com/waves

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.