Search
Find a vulnerability
Search criteria
10 vulnerabilities found for Parallels Desktop for Mac by Parallels
CVE-2026-90894 (GCVE-0-2026-90894)
Vulnerability from nvd – Published: 2026-09-14 09:52 – Updated: 2026-09-15 08:49
VLAI
EPSS
VEX
Title
Parallels Desktop local privilege escalation via appliance extract argument injection
Summary
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.
After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 10:23 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.parallels.com/products/desktop/ | product |
| https://kb.parallels.com/en/131168 | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
26.4.0
Unaffected: 27.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90894",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T10:23:23.018106Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:23:46.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "Parallels Desktop",
"platforms": [
"macOS"
],
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "26.4.0"
},
{
"status": "unaffected",
"version": "27.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick | JFrog"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eParallels Desktop runs\u0026nbsp;\u003ccode\u003eprl_disp_service\u003c/code\u003e\u0026nbsp;as root. Local clients reach it on the world-writable socket\u0026nbsp;\u003ccode\u003e/var/run/prl_disp_service.socket\u003c/code\u003e.\u0026nbsp;\u003ccode\u003ePrlSrv_LoginLocal\u003c/code\u003e\u0026nbsp;accepts peer credentials. No Parallels signature. No admin group.\u003c/p\u003e\u003cp\u003eAfter login,\u0026nbsp;\u003ccode\u003ePrlSrv_InstallAppliance\u003c/code\u003e\u0026nbsp;lets you pick the appliance folder (\u003ccode\u003esVmParentPath\u003c/code\u003e). The daemon unpacks with one string,\u0026nbsp;\u003ccode\u003etar -xf \"%1\" -C \"%2\"\u003c/code\u003e, then Qt\u0026nbsp;\u003ccode\u003eQProcess::splitCommand\u003c/code\u003e\u0026nbsp;chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS\u0026nbsp;\u003ccode\u003etar --use-compress-program=\u003c/code\u003e\u0026nbsp;runs the named program as root.\u003c/p\u003e"
}
],
"value": "Parallels Desktop runs\u00a0prl_disp_service\u00a0as root. Local clients reach it on the world-writable socket\u00a0/var/run/prl_disp_service.socket.\u00a0PrlSrv_LoginLocal\u00a0accepts peer credentials. No Parallels signature. No admin group.\n\n\n\nAfter login,\u00a0PrlSrv_InstallAppliance\u00a0lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string,\u00a0tar -xf \"%1\" -C \"%2\", then Qt\u00a0QProcess::splitCommand\u00a0chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS\u00a0tar --use-compress-program=\u00a0runs the named program as root."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eJFrog has a private proof of concept that obtains root on Parallels Desktop 26.4.0. The same proof of concept does not obtain root on 27.0.1. Public exploit details are not included in this record.\u003c/p\u003e"
}
],
"value": "JFrog has a private proof of concept that obtains root on Parallels Desktop 26.4.0. The same proof of concept does not obtain root on 27.0.1. Public exploit details are not included in this record."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T08:49:26.122Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Parallels Desktop for Mac",
"tags": [
"product"
],
"url": "https://www.parallels.com/products/desktop/"
},
{
"name": "Parallels Desktop 27 updates summary",
"tags": [
"release-notes"
],
"url": "https://kb.parallels.com/en/131168"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Parallels Desktop 27.0.0 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Parallels Desktop 27.0.0 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Parallels Desktop local privilege escalation via appliance extract argument injection",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-90894",
"datePublished": "2026-09-14T09:52:43.570Z",
"dateReserved": "2026-09-14T09:33:11.942Z",
"dateUpdated": "2026-09-15T08:49:26.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31359 (GCVE-0-2025-31359)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:27
VLAI
EPSS
VEX
Summary
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:27 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
20.2.2 (55879)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:08.458Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:27:22.807674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:27:26.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "20.2.2 (55879)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:25.931Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2025-31359",
"datePublished": "2025-06-03T09:43:25.931Z",
"dateReserved": "2025-03-28T15:54:45.505Z",
"dateUpdated": "2025-06-03T13:27:26.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-54189 (GCVE-0-2024-54189)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:19
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:19 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:07.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:19:44.951627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:19:52.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.168Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-54189",
"datePublished": "2025-06-03T09:43:27.168Z",
"dateReserved": "2024-12-05T15:34:29.663Z",
"dateUpdated": "2025-06-03T13:19:52.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-52561 (GCVE-0-2024-52561)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:18
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:18 UTC
CWE
- CWE-708 - Incorrect Ownership Assignment
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:06.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:18:54.071719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:18:56.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-708",
"description": "CWE-708: Incorrect Ownership Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.726Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-52561",
"datePublished": "2025-06-03T09:43:27.726Z",
"dateReserved": "2024-12-05T15:34:25.357Z",
"dateUpdated": "2025-06-03T13:18:56.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36486 (GCVE-0-2024-36486)
Vulnerability from nvd – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:22
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:22 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:05.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36486",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:22:10.357632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:22:13.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:26.596Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-36486",
"datePublished": "2025-06-03T09:43:26.596Z",
"dateReserved": "2024-12-09T19:55:30.980Z",
"dateUpdated": "2025-06-03T13:22:13.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-90894 (GCVE-0-2026-90894)
Vulnerability from cvelistv5 – Published: 2026-09-14 09:52 – Updated: 2026-09-15 08:49
VLAI
EPSS
VEX
Title
Parallels Desktop local privilege escalation via appliance extract argument injection
Summary
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.
After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 10:23 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.parallels.com/products/desktop/ | product |
| https://kb.parallels.com/en/131168 | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
26.4.0
Unaffected: 27.0.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90894",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T10:23:23.018106Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:23:46.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "Parallels Desktop",
"platforms": [
"macOS"
],
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "26.4.0"
},
{
"status": "unaffected",
"version": "27.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick | JFrog"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eParallels Desktop runs\u0026nbsp;\u003ccode\u003eprl_disp_service\u003c/code\u003e\u0026nbsp;as root. Local clients reach it on the world-writable socket\u0026nbsp;\u003ccode\u003e/var/run/prl_disp_service.socket\u003c/code\u003e.\u0026nbsp;\u003ccode\u003ePrlSrv_LoginLocal\u003c/code\u003e\u0026nbsp;accepts peer credentials. No Parallels signature. No admin group.\u003c/p\u003e\u003cp\u003eAfter login,\u0026nbsp;\u003ccode\u003ePrlSrv_InstallAppliance\u003c/code\u003e\u0026nbsp;lets you pick the appliance folder (\u003ccode\u003esVmParentPath\u003c/code\u003e). The daemon unpacks with one string,\u0026nbsp;\u003ccode\u003etar -xf \"%1\" -C \"%2\"\u003c/code\u003e, then Qt\u0026nbsp;\u003ccode\u003eQProcess::splitCommand\u003c/code\u003e\u0026nbsp;chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS\u0026nbsp;\u003ccode\u003etar --use-compress-program=\u003c/code\u003e\u0026nbsp;runs the named program as root.\u003c/p\u003e"
}
],
"value": "Parallels Desktop runs\u00a0prl_disp_service\u00a0as root. Local clients reach it on the world-writable socket\u00a0/var/run/prl_disp_service.socket.\u00a0PrlSrv_LoginLocal\u00a0accepts peer credentials. No Parallels signature. No admin group.\n\n\n\nAfter login,\u00a0PrlSrv_InstallAppliance\u00a0lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string,\u00a0tar -xf \"%1\" -C \"%2\", then Qt\u00a0QProcess::splitCommand\u00a0chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS\u00a0tar --use-compress-program=\u00a0runs the named program as root."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eJFrog has a private proof of concept that obtains root on Parallels Desktop 26.4.0. The same proof of concept does not obtain root on 27.0.1. Public exploit details are not included in this record.\u003c/p\u003e"
}
],
"value": "JFrog has a private proof of concept that obtains root on Parallels Desktop 26.4.0. The same proof of concept does not obtain root on 27.0.1. Public exploit details are not included in this record."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T08:49:26.122Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "Parallels Desktop for Mac",
"tags": [
"product"
],
"url": "https://www.parallels.com/products/desktop/"
},
{
"name": "Parallels Desktop 27 updates summary",
"tags": [
"release-notes"
],
"url": "https://kb.parallels.com/en/131168"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Parallels Desktop 27.0.0 or later.\u003c/p\u003e"
}
],
"value": "Upgrade to Parallels Desktop 27.0.0 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Parallels Desktop local privilege escalation via appliance extract argument injection",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-90894",
"datePublished": "2026-09-14T09:52:43.570Z",
"dateReserved": "2026-09-14T09:33:11.942Z",
"dateUpdated": "2026-09-15T08:49:26.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52561 (GCVE-0-2024-52561)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:18
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:18 UTC
CWE
- CWE-708 - Incorrect Ownership Assignment
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:06.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52561",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:18:54.071719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:18:56.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-708",
"description": "CWE-708: Incorrect Ownership Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.726Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-52561",
"datePublished": "2025-06-03T09:43:27.726Z",
"dateReserved": "2024-12-05T15:34:25.357Z",
"dateUpdated": "2025-06-03T13:18:56.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-54189 (GCVE-0-2024-54189)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:19
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:19 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:07.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:19:44.951627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:19:52.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.168Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-54189",
"datePublished": "2025-06-03T09:43:27.168Z",
"dateReserved": "2024-12-05T15:34:29.663Z",
"dateUpdated": "2025-06-03T13:19:52.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36486 (GCVE-0-2024-36486)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:22
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:22 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:05.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36486",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:22:10.357632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:22:13.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:26.596Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-36486",
"datePublished": "2025-06-03T09:43:26.596Z",
"dateReserved": "2024-12-09T19:55:30.980Z",
"dateUpdated": "2025-06-03T13:22:13.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-31359 (GCVE-0-2025-31359)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:27
VLAI
EPSS
VEX
Summary
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:27 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
20.2.2 (55879)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:08.458Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:27:22.807674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:27:26.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "20.2.2 (55879)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:25.931Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2025-31359",
"datePublished": "2025-06-03T09:43:25.931Z",
"dateReserved": "2025-03-28T15:54:45.505Z",
"dateUpdated": "2025-06-03T13:27:26.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}