QwikSec

Security Database

CVE

CWE

Training

CVE-2024-14032

Published: Apr 6, 2026

Modified: Apr 6, 2026

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.

Vendor	Product	Versions
Twitch	Twitch Studio	affected `0 - <= 0.114.8`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://www.iru.com/blog/twitch-privileged-helper

technical-description

exploit

https://help.twitch.tv/s/topic/0TO3a000000kZfYGAU/twitch-studio

product

https://help.twitch.tv/s/article/recommended-software-for-broadcasting

related

https://www.vulncheck.com/advisories/twitch-studio-launcherhelper-xpc-missing-authorization-to-root-file-write

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.