EUVD-2026-41655
GHSA-f445-7g93-34v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLog in as unprivileged local Windows user
-
DeliverySet attacker-controlled AppData environment variable
-
ExploitTrigger parsecd.exe launch as NT AUTHORITY\SYSTEM
-
ExecutionSYSTEM process resolves user-controlled paths
-
ImpactExecute code as SYSTEM and take over host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Incorrect use of privileged APIs
|
| Exploitation Conditions | Requires local, interactive access to a Windows host running Unity Parsec at or below v2026-05-04.0 as a normal (unprivileged) user; the attacker must be able to set/control the AppData environment variable in their own session and induce an instance of parsecd.exe to launch in the NT AUTHORITY\SYSTEM context. Limiting factors: exploitation is local-only (no network vector), so remote attackers cannot trigger it, and it depends on the vulnerable Parsec Windows host being installed and reachable by a logged-in user - hosts upgraded to 150-104a or not running the Parsec daemon are not exploitable, and single-user endpoints with no untrusted local account are low practical risk. |
| Impact | The published CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) captures the full SYSTEM-compromise impact but is optimistic on privileges: this is a local elevation-of-privilege issue, so the attacker must already be a logged-in user on the host, which is more honestly modeled as PR:L than PR:N - flag this PR:N-versus-local-EoP tension when triaging. There is no remote vector (AV:L), no user interaction beyond the attacker's own actions, and complexity is low. No EPSS probability and no KEV listing were provided, so there is no signal of mass or automated exploitation; however, a named GitHub repository plus a detailed researcher blog mean working exploit knowledge is public, raising practical risk on multi-user, RDP, or kiosk Windows hosts where untrusted users can obtain a shell. Net assessment: a credible local privilege-escalation priority where Parsec runs on shared systems, but only low-to-moderate concern on single-user endpoints because it cannot be triggered remotely or without local access. |
| Exploit ScenarioDerived | A standard (non-admin) user logged into a shared Windows workstation that has Parsec installed sets the AppData environment variable to a directory they control, then triggers the code path that spawns parsecd.exe as NT AUTHORITY\SYSTEM. The SYSTEM process resolves attacker-controlled paths from that AppData value, letting the user execute code or load resources as SYSTEM and take over the machine. Publicly available exploit code (a dedicated GitHub repository and researcher blog) lowers the skill needed to reproduce this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 04, 2026
Local privilege escalation in Unity Parsec for Windows (all builds through v2026-05-04.0) lets an unprivileged local user coerce an instance of parsecd.exe to run as NT AUTHORITY\SYSTEM while honoring a user-controlled AppData environment variable, allowing the attacker to redirect the privileged process to resources under their control and gain SYSTEM. The flaw is a CWE-648 misuse of privileged APIs; publicly available exploit code exists (a dedicated CVE GitHub repository and a researcher write-up), and it is fixed in Parsec for Windows 150-104a. It is not listed in CISA KEV and no EPSS score was supplied, so there is no evidence of widespread active exploitation.
RemediationAI
Vendor-released patch: Parsec for Windows version 150-104a - upgrade every Windows host running Parsec to this build or later, per the vendor advisory at https://support.parsec.app/hc/en-us/articles/50612943726612-CVE-2026-54424. Until patched, reduce exposure by limiting interactive/local logon on machines where the privileged Parsec host runs (the flaw requires local access), accepting the trade-off of reduced shared-host convenience; where feasible restrict Parsec host installs to single-trusted-user systems and avoid running the host on multi-user, RDP, or kiosk endpoints where untrusted users can get a shell. As a detection stopgap, monitor for unexpected parsecd.exe instances running as NT AUTHORITY\SYSTEM and for anomalous AppData values in the SYSTEM context. These are compensating controls only and do not remove the flaw, so upgrading to 150-104a remains the definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Parsec is a low-latency remote desktop / game-streaming client owned by Unity; on Windows it ships a privileged host component and the parsecd.exe process. The root cause is CWE-648 (Incorrect Use of a Privileged API): a code path allows parsecd.exe to execute in the SYSTEM security context while still trusting the per-user AppData environment variable, which any interactive user can set. Because AppData normally points into the user's own profile, a SYSTEM-level process that resolves paths (config, data files, or other resources) relative to that variable can be steered to attacker-controlled locations, collapsing the trust boundary between an unprivileged user and SYSTEM. The affected component is identified by CPE cpe:2.3:a:unity:parsec:*:*:*:*:*:*:*:* on Windows hosts.
Know when Unity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local elevation of privilege requires an already-authenticated low-privileged user (PR:L, AV:L), no interaction, and yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.
Executive ViewAI
Parsec for Windows contains a local privilege escalation vulnerability (CVE-2026-54424, CVSS 8.4) that allows unprivileged users to gain SYSTEM-level access. While publicly available exploit code exists, this vulnerability is not listed in CISA's known exploited vulnerabilities catalog, indicating limited evidence of widespread active exploitation. Organizations must patch to eliminate the risk of insiders or attackers with local access gaining administrative control of Windows systems.
Vendor-released patch: Parsec for Windows 150-104a
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
CVE-2025-59489 is a security vulnerability (CVSS 7.4) that allows argument injection that can result. Risk factors: publ
Unity before 7.2.1 does not properly handle entry activation, which allows physically proximate attackers to bypass the
Unity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which allows physically proxim
Unity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when the lock screen is activ
Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switchin
Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was ins
Exploit-DB