Slate Digital Connect 1.37.0 for macOS includes a privileged helper tool exposing an XPC service that validates clients by obtaining the client's PID and retrieving code-signing info. This PID-based validation is vulnerable to a TOCTOU race condition due to PID reuse, allowing a local attacker to trick the helper into validating a different, trusted process. This flaw can be exploited to bypass client validation and access privileged helper functions, enabling local privilege escalation.

A local attacker can exploit the PID reuse race condition to gain unauthorized access to privileged helper tool functionality. This may allow the attacker to escalate privileges on the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been published. Until a fix is available, restrict local access to trusted users only to reduce risk.