CVE-2026-24070
LPE in Native-Instruments Native Access ≤ 3.22.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-24070 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Native-Instruments Native Access. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24070 is a privilege escalation vulnerability in the Native Instruments Native Access application on macOS. The application deploys a privileged helper XPC service, com.native-instruments.NativeAccess.Helper2, during installation to handle operations such as copy-file, remove, or set-permissions via XPC communication. Access to this service requires the client process to be signed with a specific Developer ID Application certificate for Native Instruments GmbH. However, Native Access itself is signed with the entitlements com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation, enabling DYLIB injection and arbitrary code execution in the application's context.
A low-privileged local user can exploit the DYLIB injection vulnerability to impersonate the Native Access application and invoke functions in the privileged helper XPC service. This allows the attacker to delete the /etc/sudoers file and copy a malicious version in its place, achieving full root privilege escalation. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is categorized under CWE-426 (Untrusted Search Path).
Mitigation details are available in the security advisory published by SEC Consult at https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5108
Vulnerability Data
During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC service of…
more
the privileged helper is only allowed if the client process is signed with the corresponding certificate and fulfills the following code signing requirement: "anchor trusted and certificate leaf[subject.CN] = \"Developer ID Application: Native Instruments GmbH (83K5EG6Z9V)\"" The Native Access application was found to be signed with the `com.apple.security.cs.allow-dyld-environment-variables` and `com.apple.security.cs.disable-library-validation` entitlements leading to DYLIB injection and therefore command execution in the context of this application. A low privileged user can exploit the DYLIB injection to trigger functions of the privileged helper XPC service resulting in privilege escalation by first deleting the /etc/sudoers file and then copying a malicious version of that file to /etc/sudoers.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Secure baseline settings can enforce absolute, organization-controlled paths for critical resources.
Least-functionality configuration can prohibit unapproved directories or executables from being reachable via search paths.
Engineering principles such as trusted paths, complete mediation, and least privilege directly require hard-coded or validated search paths instead of external ones.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Preventing execution of unauthorized code directly blocks the malicious binaries that an untrusted search path would load.
Secure development practices include avoiding or sanitizing externally influenced search paths in application code.
Hardened configuration baselines can enforce safe search paths and restrict environment variables that enable the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover search-path issues but does not itself prevent them in production code.
Restricting software installation reduces the chance that untrusted binaries or libraries are placed in search paths.
Secure architecture principles include hard-coded or validated search paths and avoiding reliance on untrusted directories.
Secure coding standards require absolute paths or integrity-checked search paths, directly mitigating CWE-426.
Change-management processes can enforce review of path-handling changes, indirectly lowering risk.