Parallels Desktop CVE-2024-36486

Risk is CRITICAL for local users on affected systems. CVSS vector analysis: AV:L (Local Attack Vector) - requires physical or local system access; AC:L (Low Complexity) - no special conditions needed; PR:L (Low Privileges) - standard user can trigger; UI:N (No User Interaction) - fully automated; S:U (Unchanged Scope); C:H/I:H/A:H (all confidentiality, integrity, availability impacts are high). The CVSS 7.8 score accurately reflects this threat. Real-world risk is elevated because: (1) Parallels Desktop is commonly used by macOS developers and professionals who likely run privileged applications; (2) VM restoration is a normal operational procedure; (3) the attack requires only local user access, not remote; (4) exploitation is straightforward once the hard link is created. This is not a low-real-risk high-CVSS issue—the attack vector, low complexity, and high impact make this a genuine priority. Automatable: Yes, exploitation can be fully scripted. Technical impact: Complete system compromise via privilege escalation. Likelihood of exploitation: High among targeted users.

A local macOS user (e.g., developer with standard user privileges) on a system running Parallels Desktop 20.1.1 performs the following: (1) Obtains or creates a malicious VM archive file; (2) Before initiating restoration via Parallels UI or CLI, creates a hard link from the archive's destination path (e.g., ~/Parallels/MyVM.pvm/config.pvs) to a sensitive system file such as /etc/sudoers; (3) Triggers VM archive restoration through Parallels Desktop, which invokes prl_vmarchiver with root privileges; (4) prl_vmarchiver decompresses the archive and writes content to the hard-linked path without validating pathname security; (5) The attacker's sensitive file (/etc/sudoers) is overwritten with archive content, or crafted archive content grants the attacker sudo privileges; (6) Attacker gains root-level command execution. No public POC is referenced in standard CVE databases, but the vulnerability is straightforward enough that a skilled attacker can develop one. The low complexity and local access requirement mean this is a practical threat in shared macOS environments or to users who may restore VM archives from untrusted sources.