Executive brief
Slate Digital Connect, a macOS application used to manage audio plugin installations and licenses, contains a security flaw in its background maintenance tool. A local attacker on the computer can trick this tool into granting them administrative (root) privileges. This could allow a standard user to take full control of the system, access sensitive data, or disable security software.
Technical details
The Slate Digital Connect privileged helper tool (com.slatedigital.connect.privileged.helper.tool) exposes an XPC service that performs client validation using the process identifier (PID) of the connecting client. Specifically, it uses the PID to retrieve code-signing information via SecCodeCopyGuestWithAttributes. This implementation is vulnerable to a Time-of-Check Time-of-Use (TOCTOU) race condition because PIDs can be recycled by the operating system. A local attacker can initiate a connection and then quickly replace their process with a trusted binary, causing the helper tool to validate the trusted process's signature while granting privileged access to the attacker's original request. This allows for arbitrary command execution as root. As of the advisory date, the vendor has not released a patch.
Affected products
- Slate Digital Connect 1.37.0
Timeline
- 2026-01-21: other: Initial vendor contact attempt
- 2026-06-10: disclosed: Public advisory released by SEC Consult
- 2026-06-10: advisory: CVE published to NVD