CVE-2024-14032

EUVD-2024-55535
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
Affected Products (NVD)
VendorProductVersion
twitchtwitch_studio
𝑥
≤ 0.114.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://help.twitch.tv/s/article/recommended-software-for-broadcasting
https://help.twitch.tv/s/topic/0TO3a000000kZfYGAU/twitch-studio
https://www.iru.com/blog/twitch-privileged-helper
https://www.vulncheck.com/advisories/twitch-studio-launcherhelper-xpc-missing-authorization-to-root-file-write