The privileged helper tool com.slatedigital.connect.privileged.helper.tool, installed by Slate Digital Connect 1.37.0 for macOS, exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. Validation of XPC clients relies on the client's process identifier, which is then used to retrieve code‑signing information for that process. Because operating systems can recycle process identifiers, a time‑of‑check to time‑of‑use race condition exists in this validation. A local attacker can trigger the helper to validate against a process that previously held a trusted PID, thereby gaining unauthorized access to privileged helper functionality and potentially causing local privilege escalation.

Slate Digital Connect 1.37.0 for macOS is affected. The vulnerability applies to any macOS installation of this application that installs the privileged helper tool and its XPC service.

The CVSS score is 8.4, and the EPSS score is 0.0002 (less than 1%), indicating a very low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog, indicating no observed widespread exploitation. To exploit the flaw, an attacker must be able to run code locally on the same machine and manipulate PID reuse, which typically requires administrative privileges or an existing local foothold. If successful, the attacker could invoke privileged helper actions and elevate local privileges. While the local nature of the attack and lack of known public exploits reduce imminent risk, the potential impact of local privilege escalation remains significant. The vulnerability does not allow network‑based exploitation and is confined to systems running the specified version of Slate Digital Connect.