DeskIn: Local privilege escalation to root via unauthenticated XPC service
Summary
DeskIn macOS client versions up to and including 3.3.4.3 contain a root daemon (DeskIn_Service) whose XPC service com.deskin.service.installer does not verify connecting clients. A local user without administrator rights can invoke the installer method and run an attacker-supplied installer package as root, gaining full control of the Mac. The attacker needs a local unprivileged account or an app already running on the system; no remote attack path is indicated.
Affected
- Zuler Technology DeskIn (macOS client), versions 0 to 3.3.4.3
- Component: DeskIn_Service (root daemon) and XPC service com.deskin.service.installer
Fixed in
Unknown. No vendor patch was confirmed at the time of publication. VulDB suggests version 3.3.4.4 or later, which the vendor has not confirmed.
Workaround
- Disable DeskIn_Service if it is not strictly needed.
- Uninstall the DeskIn macOS client until a vendor fix is available.
- Keep macOS Gatekeeper and System Integrity Protection enabled (generic hardening, does not fix the flaw).
Exploitation
- Public proof of concept available (researcher repository on GitHub).
- No known exploitation in the wild; not listed in CISA KEV according to Strix.
- EPSS 0.00189 (low). CISA SSVC: exploitation PoC, not automatable, total technical impact.
Our recommendation
- Check whether DeskIn is installed on macOS devices.
- Uninstall DeskIn or disable DeskIn_Service where it is not needed.
- Where the software must stay, restrict use to trusted users and monitor vendor channels for a confirmed fixed build.
- Do not treat 3.3.4.4 as a fix until Zuler confirms it.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Cr0wld3r/CVE-2026-11318
Research sources
- DeskIn vendor website deskin.io
- VulnCheck advisory www.vulncheck.com
- GitHub PoC repository (Cr0wld3r) github.com
- VulDB CVE-2026-11318 vuldb.com
- VulDB entry 415662 vuldb.com
- Strix CVE-2026-11318 www.strix.ai
- Vulners RAPID7:CVE-2026-11318 vulners.com
- Sploitus PoC listing sploitus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:06.
Original description (NVD)
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.