Description (CNA)
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Zuler Technology / DeskIn | affected 0 through 3.3.4.3 |
CWE
CWE-306
References
- https://github.com/Cr0wld3r/CVE-2026-11318
- https://deskin.io/
- https://www.vulncheck.com/advisories/deskin-xpc-service-privilege-escalation-via-unauthenticated-installer
ADP enrichment
No English description supplied.
No references supplied.