The Vienna Assistant's privileged helper uses NSXPC for IPC but does not authenticate clients in the "shouldAcceptNewConnection" function. This lack of validation permits any process to connect to the XPC listener and call all functions defined in HelperToolProtocol. Notably, the functions "writeReceiptFile" and "runUninstaller" do not perform any internal validation, allowing an attacker to write files to arbitrary locations and execute arbitrary files with arbitrary arguments. This missing authentication leads to privilege escalation on affected versions (1.2.542).

An attacker with local access can exploit this vulnerability to escalate privileges by writing arbitrary files to any location and executing arbitrary files with any arguments. This compromises confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Vienna Symphonic Library GmbH advisories for updates. Until a fix is available, restrict local access to trusted users and processes to reduce risk.