Executive brief
Vienna Assistant for macOS, a tool used to manage music software and libraries, contains a security flaw in its background helper service. This flaw allows a malicious program already on the computer to gain full administrative control (root access) over the system. An attacker could use this to modify system files, steal sensitive data, or disrupt operations.
Technical details
The VSL privileged helper utilizes the NSXPC framework for inter-process communication (IPC) but fails to implement client validation within the 'shouldAcceptNewConnection' function. Because the service does not verify the identity or entitlements of connecting clients, any local process can connect to the XPC listener and invoke methods defined in the HelperToolProtocol. Specifically, the 'writeReceiptFile' and 'runUninstaller' functions lack argument validation, enabling an attacker to write arbitrary data to any file system location or execute arbitrary files with root privileges. This leads to local privilege escalation (LPE) from a standard user to root. As of the advisory date, the vendor has not provided a patch.
Affected products
- Vienna Symphonic Library (VSL) Vienna Assistant (macOS) 1.2.542
Timeline
- 2026-01-10: other: Vulnerability discovered
- 2026-01-21: other: Initial vendor contact attempted
- 2026-03-26: advisory: Public release of advisory by SEC Consult