CVE-2019-5013

Executive Summary

CVE-2019-5013 is a local privilege escalation vulnerability in the Wacom driver update helper service, version 6.3.32-3, affecting macOS systems. The flaw resides in the start/stopLaunchDProcess command, which executes launchctl under root context with a user-supplied string argument, allowing a local user to load arbitrary LaunchD agents with elevated privileges. Successful exploitation grants an attacker root-level persistence on the target machine. No vendor patch has been released, and there is no evidence of exploitation in the wild or inclusion in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability is a classic command injection / improper input validation flaw in a privileged helper process. The Wacom update helper service runs with root privileges to manage LaunchD processes for the driver. The start/stopLaunchDProcess command accepts a user-supplied string that is passed directly to launchctl without sanitization or validation. Because the helper executes under the root context, an attacker who can invoke this command (via the XPC interface or other IPC mechanism) can supply arbitrary arguments to launchctl, including the path to a malicious LaunchD agent plist they control.

The attack surface is the local IPC interface exposed by the Wacom update helper service. Any local user — regardless of administrative privileges — can interact with this service if it is reachable. The vulnerability bypasses macOS's standard privilege separation model because the helper is trusted by the system and runs with escalated privileges. The command injection occurs at the point where user input is concatenated into the launchctl invocation.

From a technical standpoint, the flaw class is CWE-78 (OS Command Injection). The mechanism does not require a network component; it is purely local. The attacker needs to craft an argument string that, when passed to launchctl, causes it to load a plist file they have written to disk (e.g., in a user-writable directory). LaunchD then reads the plist and executes the specified program with root privileges.

Note: The NVD description does not specify the exact IPC mechanism (XPC vs. distributed notification) or the function signatures within the helper service. This report does not fabricate those details.

Exploitation Scenarios

The attack chain for CVE-2019-5013 is entirely local and requires the attacker to have a user account on the target macOS system.

1. Reconnaissance / Target Identification: The attacker identifies that the system has Wacom driver version 6.3.32-3 installed. This can be done by checking /Applications/Wacom Tablet.localized or querying for the running helper process (e.g., ps aux | grep Wacom). The attacker also enumerates their own write privileges to determine a location for a malicious plist file.

2. Triggering the Flaw: The attacker crafts a malicious LaunchD agent plist file. This plist defines a program to be executed with root privileges (e.g., a reverse shell or a tool that adds the attacker's user to the admin group). The attacker then invokes the vulnerable start/stopLaunchDProcess command through the XPC interface exposed by the helper service. The argument passed is the path to the malicious plist, combined with a subcommand (e.g., load /path/to/malicious.plist).

3. Payload / Execution at Vulnerability-Class Level: Since the user-supplied string is passed directly to launchctl under root context, the attacker can execute any launchctl subcommand with elevated privileges. The payload is the plist file itself, which is loaded into LaunchD. Upon loading, LaunchD executes the program specified in the plist with root privileges — no additional authentication is required.

4. Post-Exploitation Impact: The attacker gains the ability to execute arbitrary code with root privileges. This grants full control over the system: reading any file, installing additional software or persistence mechanisms, disabling security controls (e.g., SIP, FileVault), and establishing a stealthy privilege escalation that survives reboots via the loaded LaunchD agent. The attacker does not require a reboot to achieve impact — the agent can be triggered immediately.

Because no public PoC has been identified, the exact invocation details (e.g., the precise command syntax or XPC message format) are not available. The attack chain above is inferred from the vulnerability class and the description. A motivated attacker would likely reverse-engineer the IPC interface to identify the message format.

Impact Assessment

The primary impact is complete loss of confidentiality and integrity on the affected macOS host. The CVSS score of 7.1 (High) reflects the following:

• Attack Vector: Local (AV:L) — The attacker must have local access to the machine (a valid user account). This reduces the severity relative to a network-based attack but does not remove the business risk for shared or multi-user environments.
• Attack Complexity: Low (AC:L) — Exploitation does not require special conditions; the attacker only needs to invoke the helper.
• Privileges Required: Low (PR:L) — Any local unprivileged user can trigger the flaw.
• User Interaction: None (UI:N) — No victim action is required.
• Confidentiality & Integrity Impact: High (C:H, I:H) — Root-level execution allows reading sensitive data and modifying system files.
• Availability Impact: None (A:N) — The vulnerability does not inherently cause denial of service, though a malicious agent could be designed to do so.

Business Impact: For organizations using Wacom tablets on macOS, any user with local access to a machine with the vulnerable driver can escalate to root. In environments with shared workstations or where users have BYOD privileges, this represents a significant internal threat. The lack of a vendor patch means that affected systems remain vulnerable indefinitely, unless the driver is removed or compensated with third-party controls. The confidentiality impact is especially concerning for systems storing sensitive files (e.g., design documents, credentials, PII).

Blast Radius: The blast radius is limited to a single host per exploitation event, but the root-level access granted enables deep persistence and lateral movement preparation within a broader network. In a managed enterprise, an attacker with root on one machine may extract credentials or access tokens to pivot to other systems.

Detection Guidance

Sigma Rule

title: Wacom Helper Service LaunchD Privilege Escalation
id: 7f9c3c1e-3b8d-4a2e-9f6d-1a2b3c4d5e6f
status: experimental
description: Detects invocation of the Wacom update helper service with arguments that load arbitrary LaunchD agents, indicating possible CVE-2019-5013 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-5013
author: Valtersit Threat Intel
date: 2025/03/01
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/Wacom Helper'
        CommandLine|contains:
            - 'start/stopLaunchDProcess'
            - 'load'
            - 'launchctl'
    filter:
        CommandLine|contains: '/Library/Application Support/Tablet/Wacom'
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate Wacom driver updates
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve-2019-5013

YARA Rule

rule Wacom_LaunchD_Privilege_Escalation_CVE_2019_5013
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects Wacom helper binary or accompanying plist files that may indicate CVE-2019-5013 exploitation"
        cve = "CVE-2019-5013"
    strings:
        $a = "start/stopLaunchDProcess" ascii wide
        $b = "launchctl" ascii wide
        $c = "/Library/Application Support/Tablet/Wacom" ascii wide
    condition:
        uint16(0) == 0xCFFA and any of them
}

Suricata IDS Rule

Note: This vulnerability is local; network-based detection is limited. The rule below targets RDP or shell activity that would indicate post-exploitation communications.

alert tcp any any -> any any (msg:"CVE-2019-5013 - Wacom Privilege Escalation Exfil/Remote Shell"; flow:established,to_server; content:"/bin/sh|00|" or content:"whoami" within 200; classtype:attempted-admin; reference:cve,CVE-2019-5013; sid:10005013; rev:1;)

Elastic Detection

process where event.module == "endpoint" and process.name == "launchctl" and process.args == "load" and not process.args : "/Library/Application Support/Tablet/Wacom*"

Splunk SPL Query

index=main sourcetype=XmlWinEventLog:Security OR sourcetype=macos_process
| where Image LIKE "%Wacom%" OR CommandLine LIKE "%launchctl%load%"
| search CommandLine LIKE "%start/stopLaunchDProcess%"
| stats count by Image, CommandLine, user
| where count > 0

Wazuh OSSEC Rule

<group name="local_poc,">
  <rule id="100513" level="12">
    <if_sid>550</if_sid>
    <field name="win.event.type">Process Create</field>
    <field name="win.event.cmdline" type="pcre2">(?i)Wacom.*launchctl.*load</field>
    <description>CVE-2019-5013: Wacom helper service invoked with launchctl load - potential privilege escalation.</description>
    <options>no_full_log</options>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No vendor fix has been identified. The following steps reduce exposure:

1. Immediate Mitigations (without removing driver):

   • Disable the Wacom update helper service: sudo launchctl unload /Library/LaunchDaemons/com.wacom.*.plist.
   • Restrict user access to the helper service by modifying XPC access control or removing the helper binary from execution paths.
   • Use a software restriction policy (macOS Configuration Profile) to block execution of the Wacom helper binaries.
   • Monitor macOS unified logs for launchctl load operations referencing user-writable directories.

2. Patch / Upgrade Steps: Contact Wacom support directly to request a patched driver version. If no fix exists, the only reliable remediation is to uninstall the Wacom driver entirely (removing the helper and LaunchDaemon) from all affected systems. Replace with alternative tablet drivers if available, or restrict Wacom tablet use to machines that do not handle sensitive data.

3. Long-Term Hardening:

   • Enforce Principle of Least Privilege: remove local admin rights from standard users.
   • Enable and enforce full-disk encryption to mitigate data exfiltration if root is obtained.
   • Use managed endpoints (MDM) to inventory and control third-party drivers.
   • Monitor your environment for any local privilege escalation chains that chain from this CVE; implement behavioral detection for launchctl usage by non-root users.

References

1. NVD — CVE-2019-5013: https://nvd.nist.gov/vuln/detail/CVE-2019-5013
2. Wacom Official Product Page (driver version history): https://www.wacom.com/support/product-support
3. Talos Intelligence Blog (research on local privilege escalations in drivers — note: Talos reported this CVE): https://talosintelligence.com/vulnerability_reports/ (search for CVE-2019-5013)
4. CISA Known Exploited Vulnerabilities Catalog (confirming NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known active threat actor campaigns or notifications of exploitation in the wild were identified at the time of writing. This may change as the vulnerability remains unpatched, and enterprise defenders should treat it as a latent risk for insider threat scenarios.