CVE-2026-24066

The record

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing authority. A local attacker can sign a malicious client with a self-signed certificate containing the expected organizational unit value and connect to the privileged XPC service. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.

Affected packages

Related vulnerabilities

• CVE-2026-73542 Multiple SEIKO EPSON printers and scanners contain revoked root certificates. CWE-296
• CVE-2026-42789 Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP… CWE-296
• CVE-2025-10539 Due to improper TLS certificate validation in the DeskTime Time Tracking App before… CWE-296
• CVE-2026-33779 An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper… CWE-296
• CVE-2026-27134 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in… CWE-296
• CVE-2026-27133 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in… CWE-296