VulnerabilityAnalyzed

CVE-2026-24071

This is considered insecure and can be exploited by PID reuse attacks.

HIGH 7.8EPSS 0.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.15% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-367
Affected: native-instruments/native access
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.