CVE-2026-24064 is a local privilege escalation vulnerability in Waves Central for macOS versions 13.0.9 through 16.5.5. The issue arises because a trusted XPC client component, signed with hardened runtime entitlements, permits dynamic library injection through the DYLD_INSERT_LIBRARIES environment variable. An attacker with local access can inject a malicious dynamic library into this trusted process at launch. The injected code runs within the signed process context and can interact with the product's privileged helper service to perform privileged operations, resulting in arbitrary code execution as root. The vulnerability is resolved in version 16.6.2.

Successful exploitation allows a local attacker to escalate privileges to root by injecting malicious code into a trusted process. This leads to arbitrary code execution with full system privileges, compromising system integrity and security.

A fix is available in Waves Central version 16.6.2. Users should upgrade to this version or later to remediate the vulnerability. No other mitigation guidance is provided or necessary as the issue is addressed by the official update.