Waves Central for macOS versions 13.0.9 through 16.5.5 contains a local privilege escalation vulnerability in its privileged helper service. The service validates connecting XPC clients by checking the client’s process identifier (PID) against its code‑signing identity. Because PIDs can be reused, an attacker who is able to start a local process can exploit a race condition between the connection request and the helper’s validation step, causing the helper to incorrectly trust the attacker‑controlled process. Once validated, the attacker can invoke privileged operations, resulting in arbitrary code execution as root.

The affected systems are macOS installations running Waves Central for Waves Audio Ltd. versions 13.0.9 to 16.5.5 inclusive.

The vulnerability can only be exploited locally and requires the attacker to run a process on the target machine. No exploitation probability score or KEV listing is available, but the CVSS score of 8.1 indicates a very high severity and the impact of achieving root execution is very severe. Attackers can achieve complete control over the affected system, compromising confidentiality, integrity, and availability. The risk remains high until the affected versions are upgraded or the helper service is disabled.