CVE-2026-11318

HIGH 7.8

Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.

CWE	CWE-306
Vendor	zuler technology
Product	deskin
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for zuler technology deskin

Be the first to know when new high vulnerabilities affecting zuler technology deskin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Zuler Technology / DeskIn

0 ≤ 3.3.4.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cr0wld3r/CVE-2026-11318 deskin.io: https://deskin.io/ vulncheck.com: https://www.vulncheck.com/advisories/deskin-xpc-service-privilege-escalation-via-unauthenticated-installer

Credits

Long, Dang Hoang of SACOMBANK