The vulnerability resides in the Waves Central privileged helper service on macOS, which authenticates XPC clients by comparing the caller's code‑signing certificate chain to its own instead of validating against a pinned requirement. A local authenticated user can supply a process signed by the same team ID, pass the helper’s check, and cause the helper to execute a script with root privileges. This flaw allows the attacker to gain root access, enabling full system compromise.

Vulnerable versions of Waves Central for macOS prior to 17.0, distributed by Waves Audio Ltd. The issue affects the helper component used by the application on all macOS releases before 17.0.

With a CVSS score of 8.4 the severity is high, though the EPSS score is not available and it is not listed in the CISA KEV catalog. The attack requires local authenticated access, so an insider or an attacker who has logged into the system can exploit it immediately. The high score reflects the ability to obtain root privileges and the potential for widespread impact.