CVE-2026-24064: Waves Central macOS Privilege Escalation (CVSS 7.8)

Technical summary

The vulnerability stems from an XPC client component in Waves Central that is signed with hardened runtime entitlements but does not prevent dynamic library injection. An attacker can exploit DYLD_INSERT_LIBRARIES environment variable injection to load an attacker-controlled dynamic library into the trusted, signed process at launch time. Because the injected code executes within the context of the hardened runtime process, it gains the ability to communicate with Waves Central's privileged helper service and invoke privileged operations, ultimately achieving arbitrary code execution with root-level privileges.

Business impact

Organizations deploying Waves Central on macOS infrastructure—particularly those in audio production, post-production, and media workflows—face elevated risk. Any local user on an affected machine can escalate to root and compromise the entire system, potentially affecting sensitive content, intellectual property, and downstream production pipelines. Remediation requires immediate patching to version 16.6.2 to eliminate the attack surface.

Affected systems

Waves Central for macOS versions 13.0.9 through 16.5.5 are vulnerable. Version 16.6.2 and later are not affected. Systems running versions outside this range are not impacted by this specific flaw. Verify your installed version via Waves Central's About or Help menu.

Exploitability

This vulnerability has a low attack complexity and requires only user-level privileges to trigger; no user interaction is needed. Any local account on the machine can exploit it. However, it does require local access, limiting exploitation to insider threats, supply-chain compromises, or scenarios where an attacker has already achieved initial access to the system. The attack is straightforward from a technical perspective and does not depend on defeating additional hardening measures.

Remediation

Update Waves Central to version 16.6.2 or later. This is a mandatory update for all users running affected versions. No workarounds exist that eliminate the root cause. After patching, verify the new version is active and no legacy processes are still running the vulnerable code.

Patch guidance

Download and install Waves Central version 16.6.2 or later from the official Waves website or through Waves' in-application update mechanism. Test the update in a non-critical environment first if possible to ensure compatibility with your audio workflows and dependent plugins. After installation, restart any running Waves applications and verify the version number to confirm successful deployment.

Detection guidance

Monitor for exploitation attempts by logging processes launched with DYLD_INSERT_LIBRARIES set, unusual child processes spawned by Waves Central components, and unexpected root-level process creation. Query installed Waves Central versions via software inventory tools or command-line version checks (e.g., `defaults read` for application bundles). Look for evidence of privilege escalation in system logs and audit trails following suspicious Waves process execution.

Why prioritize this

This vulnerability combines high-impact privilege escalation with low exploitation friction. The CVSS 3.1 score of 7.8 (HIGH) reflects the severity: arbitrary code execution as root from a low-privileged account. Although the KEV catalog has not yet flagged this vulnerability, the straightforward nature of the exploit, the maturity of the underlying DYLD injection technique, and the broad deployment of Waves Central in creative industries warrant urgent prioritization. Any local access scenario should be treated as a potential attack vector.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, and impact to Confidentiality, Integrity, and Availability all High. The vulnerability is not ranked as Critical because it requires local access; however, the complete lack of friction in exploitation and the severity of the impact (root code execution) justify the HIGH rating. Organizations should treat this as equivalent to a critical flaw in their risk models.

Frequently asked questions