EUVD-2026-41655
GHSA-f445-7g93-34v9
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local elevation of privilege requires an already-authenticated low-privileged user (PR:L, AV:L), no interaction, and yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.
AnalysisAI
Local privilege escalation in Unity Parsec for Windows (all builds through v2026-05-04.0) lets an unprivileged local user coerce an instance of parsecd.exe to run as NT AUTHORITY\SYSTEM while honoring a user-controlled AppData environment variable, allowing the attacker to redirect the privileged process to resources under their control and gain SYSTEM. The flaw is a CWE-648 misuse of privileged APIs; publicly available exploit code exists (a dedicated CVE GitHub repository and a researcher write-up), and it is fixed in Parsec for Windows 150-104a. It is not listed in CISA KEV and no EPSS score was supplied, so there is no evidence of widespread active exploitation.
Technical ContextAI
Parsec is a low-latency remote desktop / game-streaming client owned by Unity; on Windows it ships a privileged host component and the parsecd.exe process. The root cause is CWE-648 (Incorrect Use of a Privileged API): a code path allows parsecd.exe to execute in the SYSTEM security context while still trusting the per-user AppData environment variable, which any interactive user can set. Because AppData normally points into the user's own profile, a SYSTEM-level process that resolves paths (config, data files, or other resources) relative to that variable can be steered to attacker-controlled locations, collapsing the trust boundary between an unprivileged user and SYSTEM. The affected component is identified by CPE cpe:2.3:a:unity:parsec:*:*:*:*:*:*:*:* on Windows hosts.
RemediationAI
Vendor-released patch: Parsec for Windows version 150-104a - upgrade every Windows host running Parsec to this build or later, per the vendor advisory at https://support.parsec.app/hc/en-us/articles/50612943726612-CVE-2026-54424. Until patched, reduce exposure by limiting interactive/local logon on machines where the privileged Parsec host runs (the flaw requires local access), accepting the trade-off of reduced shared-host convenience; where feasible restrict Parsec host installs to single-trusted-user systems and avoid running the host on multi-user, RDP, or kiosk endpoints where untrusted users can get a shell. As a detection stopgap, monitor for unexpected parsecd.exe instances running as NT AUTHORITY\SYSTEM and for anomalous AppData values in the SYSTEM context. These are compensating controls only and do not remove the flaw, so upgrading to 150-104a remains the definitive fix.
Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.
In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin
Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was ins
Same weakness CWE-648 – Incorrect Use of Privileged APIs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today