CVE-2026-11318

Summary

The Deskin installer service allows unprivileged local users to execute arbitrary packages as root without authentication, enabling privilege escalation to full system compromise. This vulnerability is particularly dangerous because it can be exploited by any local user to gain root access.

Exploitability

Exploitation is relatively straightforward requiring only local user access and the ability to connect to an XPC service, with no additional authentication required for the privileged installer method.

Blast radius

If exploited, this vulnerability could lead to complete system compromise allowing attackers to install malicious software, modify system files, and maintain persistent access across reboots.

Detection

Monitor for unauthorized connections to the com.deskin.service.installer XPC service and execution of installer packages with elevated privileges, particularly those initiated by non-root users.

Prioritized remediation

Upgrade to Deskin version 3.3.4.4 or later to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.