CVE-2024-14032

CVE-2024-14032 is a privilege escalation vulnerability affecting Twitch Studio version 0.114.8 and earlier, caused by an unprotected XPC service in the application's privileged helper tool. The flaw allows local attackers to execute arbitrary code as root by exploiting the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, resulting in complete system compromise. With a CVSS score of 7.8 (HIGH), the vulnerability requires local access with low privileges and has high impact across confidentiality, integrity, and availability. The attack presents a low exploit barrier given the straightforward nature of invoking the vulnerable XPC method. Exploitation activity appears minimal at present, as the vulnerability is not tracked on the Known Exploited Vulnerabilities catalog and shows no evidence of active in-the-wild attacks, though the risk profile remains elevated due to the severity of potential impact and the simplicity of exploitation. It should be noted that Twitch Studio was discontinued in May 2024, reducing the practical attack surface.