The vulnerability in Slate Digital Connect 1.37.0 arises from improper validation of the certificate chain in the privileged helper tool's XPC service. The helper tool checks only the subject organizational unit (OU) of the client's signing certificate but does not verify that the certificate chains to a trusted code-signing authority. Consequently, a local attacker can create a self-signed certificate with the expected OU value and connect to the privileged service, bypassing intended security controls and enabling unauthorized privileged operations.

An attacker with local access can exploit this vulnerability to gain unauthorized access to privileged helper functionality. This may lead to local privilege escalation, allowing the attacker to perform actions with elevated privileges that are normally restricted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users and monitor for suspicious activity involving the privileged helper tool.