Wacom tablet not working on macOS 27

Wacom driver 6.4.13-4 does not support macOS 27. The driver installs, the services run, and the tablet is ignored. This repo patches the version check that causes it and fixes the code-signing problems that patching creates.

Tested on macOS 27.0 (build 26A5388g), Apple Silicon, Wacom Intuos S (CTL-4100), driver 6.4.13-4.

Symptoms

Any of these, after updating to macOS 27:

• Wacom Center says "The tablet driver is not responding. Please restart Wacom Center."
• Wacom Center reports it cannot load the drivers
• The pen moves nothing. The tablet is dead, but it shows up in System Information
• Wacom shows as "Running in background" in Login Items while nothing works
• "Wacom Tablet Software needs to restart to activate Accessibility permissions" appears again every time you dismiss it
• Hundreds of crash reports in ~/Library/Logs/DiagnosticReports named TabletDriver-*.ips or Wacom_IOManager-*.ips
• Crash reports containing SIGKILL (Code Signature Invalid) and "namespace": "CODESIGNING", "indicator": "Invalid Page"

The last two mean something already modified the driver binaries without re-signing them. If you ran another patch before finding this repo, start at Already tried another patch.

Quick start

git clone https://github.com/MohamadAshrafSalama/wacom-macos27-driver-fix.git
cd wacom-macos27-driver-fix
bash diagnose.sh
sudo bash patch.sh

Then grant Accessibility by hand. That step cannot be scripted; see The one manual step.

Install the official driver from wacom.com first if you do not have it. The patch modifies an existing install, it does not provide one.

What is actually broken

The driver contains a hardcoded guard that treats any macOS newer than 26.9 as an unknown release:

if (isPlatformVersionAtLeast(1, 26, 10)) {
    // unrecognised OS, refuse to initialise
}

macOS 27.0 satisfies that test, so SystemState::SetOSType() classifies the system as undefined and the driver stack never finishes starting. The processes stay alive and do nothing, which is why the tablet appears connected but dead.

On arm64 the check compiles to four MOVZ instructions:

52800020    mov w0, #1
52800341    mov w1, #26     <- the version
52800142    mov w2, #10
52800003    mov w3, #0

patch.sh rewrites w1 to the major version you are running, so macOS 27.0 falls below the 27.10 threshold and passes. The x86_64 slice gets the same treatment (mov esi, 26 becomes mov esi, 27). Both slices are patched, in all five binaries.

This is a workaround, not a repair. Wacom's driver still does not know what macOS 27 is; it has just stopped refusing to run on it.

The part other patches get wrong

Editing a signed binary invalidates its signature, so it must be re-signed. Two things go wrong there, and both fail silently.

Re-signing with the wrong codesign

Anaconda, Miniforge, Homebrew and several cross-compilation toolchains ship their own codesign (usually from sigtool). If one of those is earlier in PATH than /usr/bin, a script calling codesign without a full path gets the wrong binary. It rejects Apple's arguments with --sign is required, and if the script hides stderr the failure is invisible.

The result is a binary with edited code under Wacom's original Developer ID signature. macOS refuses to execute it:

exception:   EXC_BAD_ACCESS, signal: "SIGKILL (Code Signature Invalid)"
termination: namespace "CODESIGNING", indicator "Invalid Page"

That is a worse failure than the bug being fixed, and it looks nothing like it. Check with:

which codesign      # must be /usr/bin/codesign

Every script here calls /usr/bin/codesign by absolute path, so it does not matter what your PATH looks like.

Library validation blocking the drivers

An ad-hoc signature (codesign --sign -) has no Team ID. A process running under the hardened runtime cannot load a library signed by a different team, and /Library/Frameworks/WacomMultiTouch.framework is still signed by Wacom (EG27766DY7).

So after a naive re-sign, WacomTabletDriver and WacomTouchDriver start and exit immediately. Nothing crashes and nothing is logged. Wacom Center reports that the driver is not responding, and it looks like the patch did not work.

The fix is com.apple.security.cs.disable-library-validation. It has to be merged into the original entitlements. Replacing them wholesale drops com.apple.security.app-sandbox, the app groups, and the temporary-exception.mach-lookup and mach-register lists, which is how the driver reaches Wacom Center. patch.sh reads each bundle's real entitlements, adds the one key, and signs with the result.

Start order

WacomTabletDriver registers com.wacom.WacomTabletDriverMessageServer and Wacom_Driver. If it starts before Wacom_IOManager, those endpoints never appear and Wacom Center cannot find the driver. The agents must be started in this order:

com.wacom.DataStoreMgr
Wacom_IOManager
com.wacom.wacomtablet

Note that the launchd label does not always match the plist filename: com.wacom.IOManager.plist has the label Wacom_IOManager. Using the filename as a label makes launchctl bootout fail quietly.

Check which Mach services are registered with:

launchctl print gui/$(id -u) | grep -i wacom

The one manual step

Re-signing removes the Team ID, so macOS treats the patched apps as different applications from the ones you granted permissions to. Those grants are discarded and have to be given again.

Without Accessibility, WacomTabletDriver checks AXIsProcessTrusted(), fails, and exits. launchd restarts it. It exits again. The PID changes every couple of seconds and the "needs to restart" dialog keeps coming back. There are no crash reports because it is quitting cleanly.

Grant it:

1. System Settings, Privacy & Security, Accessibility

2. Remove existing Wacom entries with the minus button. They point at the old signature and will never match again

3. Add these three. Dragging them from a Finder window is easier than the file picker, because .Tablet is a hidden folder:

   /Applications/Wacom Tablet.localized/.Tablet/WacomTabletDriver.app
   /Applications/Wacom Tablet.localized/.Tablet/TabletDriver.app
   /Library/PrivilegedHelperTools/Wacom_IOManager.app
   

   To reach .Tablet in the picker, press Cmd+Shift+G and type the path. To open it in Finder: open "/Applications/Wacom Tablet.localized/.Tablet/"

4. Turn each one on. Gatekeeper will warn about an unidentified developer and may show the name as (null). That is what an ad-hoc signature looks like. Choose Open Anyway

5. Repeat in Privacy & Security, Input Monitoring

This genuinely cannot be automated. SIP discards writes to /Library/Application Support/com.apple.TCC/TCC.db even as root, silently and with no error. macOS also blocks synthetic clicks on the Privacy panes. Both are deliberate, and they are what stops malware from granting itself control. Any tool claiming to automate this either disables SIP or does not work.

Already tried another patch

If a previous attempt left modified binaries with broken signatures, do not patch on top of it. Start clean:

bash diagnose.sh          # look for SIGNATURE: INVALID
sudo bash restore.sh      # if you have a backup from patch.sh

With no usable backup, remove the driver completely and reinstall before patching. A partial uninstall leaves helpers in /Library/PrivilegedHelperTools and agents in /Library/LaunchAgents that keep crash-looping after /Applications/Wacom Tablet.localized is gone. Remove all of these:

/Library/LaunchAgents/com.wacom.*.plist
/Library/LaunchDaemons/com.wacom.*.plist
/Library/PrivilegedHelperTools/Wacom_IOManager.app
/Library/PrivilegedHelperTools/com.wacom.DataStoreMgr.app
/Library/PrivilegedHelperTools/com.wacom.UpdateHelper.app
/Library/PreferencePanes/WacomCenter.prefpane
/Library/PreferencePanes/WacomTablet.prefpane
/Library/Application Support/Tablet
/Library/Frameworks/WacomMultiTouch.framework
~/Library/Containers/com.wacom.*
~/Library/Application Scripts/com.wacom.*
~/Library/Group Containers/*com.wacom.*

Then sudo pkgutil --forget com.wacom.TabletInstaller, reboot, and install a fresh driver.

Scripts

Script	Needs sudo	What it does
diagnose.sh	no	Prints driver state, signatures, guard version, permissions, restart loops, tablet detection. Changes nothing
patch.sh	yes	Backs up, patches, re-signs with merged entitlements, restarts in order, verifies
restore.sh	yes	Puts the original binaries back from a backup

patch.sh is safe to run twice. It detects an already-patched binary and re-signs without editing it again.

Backups go to /Library/Application Support/Tablet/macos27-patch-backup-<timestamp>/ and contain the original executables plus their original entitlements.

After a driver update

Installing or updating the Wacom driver overwrites the patch and the tablet stops working again. Run patch.sh again, then re-grant Accessibility, because the reinstalled binaries are Wacom-signed and the ad-hoc grants no longer match.

Before re-patching, check whether Wacom has shipped a driver that supports macOS 27 properly. As of driver 6.4.13-4, released 28 April 2026, the supported list is macOS 13-15 and 26. When a supported build exists, install it and stop using this.

Limitations

• The version guard is the only thing changed. Anything else macOS 27 broke in the driver is still broken
• Ad-hoc signatures mean Gatekeeper warnings, and permissions must be re-granted after every patch
• Not tested on Cintiq or Intuos Pro. The code path is shared, so it should work, but reports are welcome
• Intel Macs: the x86_64 slice is patched, but this has only been verified on Apple Silicon

Reporting a problem

Run bash diagnose.sh and paste the full output. It includes the macOS build, driver version, signature state, guard version, permissions and whether the tablet is detected at all, which is everything needed to tell these failure modes apart.

Check the obvious thing first: diagnose.sh reports whether a device with Wacom's USB vendor ID (0x056a) is attached. A loose cable produces exactly the same "driver is not responding" message as a broken driver.

Credits

The version-guard offset was originally identified by rexionmars/wacom-macos27-fix. This repo reimplements the patch with absolute codesign paths, entitlement merging instead of replacement, ordered service startup, idempotent runs and verification at each step.

License

MIT. See LICENSE.

Not affiliated with or endorsed by Wacom. It modifies signed binaries on your own machine, which voids any expectation of support from Wacom. Backups are made and restore.sh reverses it, but you are responsible for what you run.