Privilege Escalation in Deskin Service on macOS by Unauthenticated Local Attackers
CVE-2026-11318

8.5HIGH

Key Information:

Vendor

Zuler Technology

Status
Deskin
Vendor
CVE Published:
8 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11318?

Deskin versions up to 3.3.4.3 have a significant vulnerability in the com.deskin.service.installer XPC service. This flaw allows local unprivileged attackers to connect to the root-owned service without authentication, enabling them to execute arbitrary installer packages as the root user. By exploiting this weakness, an attacker can invoke privileged installer methods to deploy a malicious installer, potentially leading to complete root compromise of the macOS system.

Affected Version(s)

DeskIn 0 <= 3.3.4.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-11318 - Proof of Concept

References

https://github.com/Cr0wld3r/CVE-2026-11318
technical-descriptionexploit
https://deskin.io/
product
https://www.vulncheck.com/advisories/deskin-xpc-service-p...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Long, Dang Hoang of SACOMBANK
.