CVE-2026-11318: Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service tha... (CVSS 8.5)

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.