Description
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite system files and privileged binaries, achieving full system compromise. Twitch Studio was discontinued in May 2024.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Twitch Twitch Studio
Default version status: unknown
0 to ≤ 0.114.8affected
References
- https://www.iru.com/blog/twitch-privileged-helper ↗
- https://help.twitch.tv/s/topic/0TO3a000000kZfYGAU/twitch-studio ↗
- https://help.twitch.tv/s/article/recommended-software-for-broadcasting ↗
- https://www.vulncheck.com/advisories/twitch-studio-launcherhelper-xpc-missing-authorization-to-root-file-write ↗