Twitch Studio contains a critical privilege escalation vulnerability that allows a local attacker to execute arbitrary code with root privileges due to an insecure XPC service.

This is a missing authorization vulnerability (CWE-862) within the com.twitch.LauncherHelper privileged helper tool. The tool fails to perform capability checks on its XPC interface, allowing a local attacker with low privileges to invoke methods that overwrite system files and execute arbitrary code as root.

The ability for a local attacker to achieve full system compromise presents a severe risk to organizational security. By gaining root-level access, an attacker can bypass all operating system security controls, install persistent backdoors, exfiltrate sensitive data, or disable security software. Given the CVSS score of 7.8, this vulnerability represents a significant threat to any system where the legacy Twitch Studio helper binary remains present.

Immediate Action: Uninstall Twitch Studio entirely and ensure the helper binary located at /Library/PrivilegedHelperTools is removed from the system, as the software is discontinued and will not receive security updates.

Proactive Monitoring: Audit macOS systems for the presence of the com.twitch.LauncherHelper binary and monitor system logs for unauthorized attempts to invoke XPC services or unexpected file modification events in protected directories.

Compensating Controls: Ensure that endpoint detection and response (EDR) solutions are configured to alert on unauthorized privilege escalation attempts and the spawning of unexpected processes from privileged helper tools.

Public Exploit Available: Yes, a technical write-up detailing the exploitation mechanism and vulnerable methods exists via the VulnCheck and Iru research references.

Because Twitch Studio was discontinued in May 2024, no vendor patch will be provided for this vulnerability. Administrators must prioritize the complete removal of the software and its associated helper components from all managed endpoints to eliminate this persistent risk of local privilege escalation. Immediate remediation is required to prevent potential system-wide compromise.