CVE-2026-24071

HighPublic PoC

Published: 02 February 2026

Published

02 February 2026

Modified

11 February 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0001 0.3th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24071 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Native-Instruments Native Access. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and IA-4 (Identifier Management).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SA-19 Component Authenticity good match

prevent

Mandates verification of software component authenticity during runtime execution, directly addressing the flawed code signature check that trusts untrusted PID in the XPC service.

IA-4 Identifier Management good match

prevent

Prevents reuse of system identifiers like PIDs for a defined time period, mitigating PID reuse attacks that enable client impersonation.

AC-24 Access Control Decisions good match

prevent

Requires access control decisions for the privileged XPC service to be based on valid identifiers and attributes, rather than untrusted PID values.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct local privilege escalation via insecure XPC client verification (PID reuse/TOCTOU) in privileged helper.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The…

connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.

Deeper analysisAI

CVE-2026-24071 is a vulnerability in the XPC service provided by the privileged helper of Native Instruments' Native Access on macOS. The issue stems from the service using the process ID (PID) of the connecting client, obtained via _xpc_connection_get_pid(), to verify the client's code signature in the hasValidSignature function. This approach is insecure because the PID value cannot be trusted, making it susceptible to PID reuse attacks, as classified under CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition). The vulnerability was published on 2026-02-02 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability by leveraging PID reuse to impersonate a legitimate signed client connecting to the privileged XPC service. The high attack complexity arises from the need to manipulate process IDs effectively, but once successful, the attacker bypasses code signature checks. This grants high-impact access to confidentiality, integrity, and availability, with a changed scope that elevates privileges through the helper tool.

For mitigation details, refer to the advisory published by SEC Consult at https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/.