{"id":"CVE-2026-24071","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-24071","generatedAt":"2026-10-28T02:20:59.970Z","title":"This is considered insecure and can be exploited by PID reuse attacks.","description":"It was found that the XPC service offered by the privileged helper of Native Access  uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.","published":"2026-02-02T14:16:36.000Z","lastModified":"2026-06-17T10:22:34.000Z","status":"Analyzed","sourceIdentifier":"551230f0-3615-47bd-b7cc-93e92e730bbf","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-367"],"affected":["native-instruments/native access"],"epss":{"score":0.00158,"percentile":0.04888,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-native-instruments-native-access-macos/","tags":["Exploit","Third Party Advisory"],"source":"551230f0-3615-47bd-b7cc-93e92e730bbf"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-24071","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}