high7.8
CVE-2026-11318
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers t…
Impact
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Deskin | Deskin | through 3.3.4.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.