{"id":"CVE-2026-11318","published":"2026-10-08T21:17:53.377","lastModified":"2026-10-09T14:17:20.393","description":"Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://deskin.io/","tags":[]},{"url":"https://github.com/Cr0wld3r/CVE-2026-11318","tags":[]},{"url":"https://www.vulncheck.com/advisories/deskin-xpc-service-privilege-escalation-via-unauthenticated-installer","tags":[]}],"exploitRefs":[{"url":"https://github.com/Cr0wld3r/CVE-2026-11318","tags":[]}],"hasPoc":true,"ai":{"summary":"The Deskin installer service allows unprivileged local users to execute arbitrary packages as root without authentication, enabling privilege escalation to full system compromise. This vulnerability is particularly dangerous because it can be exploited by any local user to gain root access.","exploitability":"Exploitation is relatively straightforward requiring only local user access and the ability to connect to an XPC service, with no additional authentication required for the privileged installer method.","blast_radius":"If exploited, this vulnerability could lead to complete system compromise allowing attackers to install malicious software, modify system files, and maintain persistent access across reboots.","remediation":"Upgrade to Deskin version 3.3.4.4 or later to remediate this privilege escalation vulnerability.","detection":"Monitor for unauthorized connections to the com.deskin.service.installer XPC service and execution of installer packages with elevated privileges, particularly those initiated by non-root users.","tags":["privilege-escalation","macos","xpc-service","local-attack"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:21:22.330Z"}}