HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-11318 — Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com....

·Source: NIST NVD

Updated:

Executive Summary

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the

Analysis

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host. CVSS Score: 7.8. Published: 2026-10-08T21:17:53.377.

Indicators of Compromise (2)

CVE (1)
CVE-2026-11318
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Neuro-Symbolic AI Could Make Computer Agents Cheaper

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/neuro-symbolic-ai-could-make-computer-agents-cheaper-image_small-6-a-33143.jpg" align=right hspace=4><b>Hybrid Neuro-Symbolic Approach Reuses Workflows, Cutting Token Costs for Repetitive Tasks</b><br>Autonomous computer company Simular found a way to run computer agents more cheaply, using a method typically used to improve accur

Bank Info Security
MEDIUMVulnerabilityNEW

Bullhorn takes staffing platform offline to contain cyberattack

Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

Two more Serbian opposition figures targeted with spyware, researchers say

A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.

The Record