What is the CVSS score of CVE-2024-52561?

CVE-2024-52561 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Parallels Desktop are affected by CVE-2024-52561?

Parallels Desktop for Mac version 20.1.1 contains a privilege escalation vulnerability that allows attackers to gain root-level access through the snapshot deletion feature.

Is there a public PoC exploit available for CVE-2024-52561?

Yes, a public proof-of-concept exploit is available for CVE-2024-52561. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-52561?

Within 24 hours: Inventory all Parallels Desktop for Mac installations and identify systems running version 20.1.1 (build 55740). Within 7 days: Disable the snapshot feature in Parallels Desktop where operationally feasible, or restrict VM snapshot operations to trusted administrators only. Within 30 days: Continuously monitor Parallels for a security patch and apply immediately upon availability; consider upgrading to newer versions if available from the vendor.

Parallels Desktop CVE-2024-52561

EUVD-2024-54641 HIGH

Incorrect Ownership Assignment (CWE-708)

2025-06-03 talos-cna@cisco.com

Privilege Escalation Parallels Desktop

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2024-54641

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

PoC Detected

Jul 02, 2025 - 14:53 vuln.today

Public exploit code

CVE Published

Jun 03, 2025 - 10:15 nvd

HIGH 7.8

DescriptionCVE.org

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.

AnalysisAI

Privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740) affecting the Snapshot deletion functionality. A local attacker with standard user privileges can exploit a symlink race condition to manipulate root-owned snapshot files, escalating privileges to root. The vulnerability has a CVSS score of 7.8 (high severity) with low attack complexity, and while specific KEV/EPSS data is not provided, the low complexity and local attack vector suggest moderate real-world exploitation probability.

Technical ContextAI

The vulnerability exists in Parallels Desktop's snapshot management system, specifically in the root service that handles snapshot deletion and file ownership verification. The root cause is classified under CWE-708 (Incorrect Ownership Assignment), indicating improper validation of file ownership before modifying it. When a snapshot is deleted, a privileged service performs ownership modifications without adequate checks for symlink attacks. An attacker can create symbolic links pointing to arbitrary files owned by root, and when the snapshot deletion routine processes these links without validating their target, the ownership is transferred to a lower-privilege user. This is a classic privilege escalation pattern exploiting the TOCTOU (Time-of-Check-Time-of-Use) race condition between ownership verification and modification. CPE notation would be: cpe:2.7:a:parallels:parallels_desktop:20.1.1:*:*:*:*:macos:*:*

RemediationAI

Parallels has not provided public patch information in the available data. Recommended actions: (1) Upgrade to a version beyond 20.1.1 once patches are released by Parallels; (2) Check Parallels advisory channels (parallels.com/products/desktop/support) for available security updates; (3) As a temporary mitigation, restrict local user access to systems running Parallels Desktop 20.1.1 to trusted users only; (4) Monitor snapshot deletion operations and file ownership changes in system logs; (5) Disable snapshot functionality if not actively needed until patching is possible. Parallels customers should contact support at https://www.parallels.com/support for official patch availability and timeline.