Is CVE-2026-11318 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-11318?

CVE-2026-11318 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-11318

Description

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.