During installation of Native Access on macOS, the installer deploys a privileged helper that communicates with the main application over XPC. The helper is protected by a strict code‑signing requirement that only allows a signed client with the specific certificate to reach it. Native Access itself is signed with permits‑dyld‑environment‑variables and disable‑library‑validation entitlements, which give an attacker the ability to inject a dynamic library into the process. A local user can then invoke functions of the privileged helper such as copy‑file or set‑permissions to delete the system /etc/sudoers file and replace it with a malicious copy, effectively granting root privileges. The vulnerability is a classic example of untrusted search path exploitation (CWE‑426) and leads to privilege escalation, compromising confidentiality, integrity and availability of the system.

Native Instruments Native Access running on macOS is affected. All versions installed on Apple macOS environments share the same code‑signing and entitlement configuration, and no specific version numbers are listed in the current advisory. Users of Native Access on macOS devices should assume the vulnerability applies until a vendor‑provided fix is issued.

The CVSS base score of 8.8 indicates a high severity for local privilege escalation. However, the EPSS score of less than 1 percent suggests a very low current exploitation probability, and the vulnerability has not yet been recorded in the CISA Known Exploited Vulnerabilities catalog. The attack requires a local user account and the ability to run Native Access; the exploit path involves manipulating DYLD environment variables to inject a library that triggers privileged helper actions. Because the vulnerable component is a helper service with elevated privileges, a successful exploitation would allow attackers to modify system files such as /etc/sudoers, resulting in full root access.