CVE-2026-24065: Waves Audio Waves Central local privilege escalation in privileged helper service

CVE-2026-24065 · Severity: info · CVSS 7.8 · Published 2026-06-09

Waves Central, a management application for professional audio software, contains a security flaw in its background helper service on macOS. A local user on the computer can exploit a timing issue to trick this service into granting administrative access. If successful, an attacker can execute commands with the highest system privileges (root), potentially leading to full system takeover, data theft, or permanent modification of the operating system.

Vendors: Waves Audio.

Quick answers

Is CVE-2026-24065 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24065 being exploited in the wild.
How severe is CVE-2026-24065?
Informational severity, with a CVSS score of 7.8, published 9 June 2026.
Which products and versions are affected?
Waves Audio Central 13.0.9 through 16.5.5.
Is there a fix for CVE-2026-24065?
A patch was published on 2026-06-09: Fixed in version 16.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24065 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-24065?
Check whether you run Waves Audio Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The privileged helper service 'com.waves.central.InstlHelper' in Waves Central for macOS (v13.0.9 - v16.5.5) performs insecure client validation of XPC connections. The service relies on the Process Identifier (PID) of the connecting client to verify its code-signing identity. Because PIDs are finite and recycled by the operating system, a local attacker can exploit a Time-of-Check Time-of-Use (TOCTOU) race condition. By timing a connection request such that a legitimate process terminates and its PID is reassigned to a malicious process before the helper performs its validation check, the attacker can bypass signature verification. This allows the attacker to invoke privileged methods such as 'executeIrlFileWithPath', resulting in arbitrary code execution with root privileges. The issue is addressed in version 16.6.2.

Affected products

  • Waves Audio Waves Central 13.0.9 through 16.5.5

Timeline

  • 2026-01-07: other: Vulnerability discovered by SEC Consult
  • 2026-06-09: disclosed: Public disclosure of CVE-2026-24065
  • 2026-06-09: patched: Fixed in version 16.6.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.