Parallels Desktop EUVD-2024-54641

The CVSS score of 7.8 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates high severity with favorable exploitation conditions: local attack vector (AV:L), low attack complexity (AC:L), requiring only low user privileges (PR:L), no user interaction needed (UI:N), with high impact across confidentiality, integrity, and availability. The low attack complexity and low privilege requirement are strong indicators this vulnerability is practically exploitable. Without active KEV/CISA listing data or confirmed public POC, the immediate real-world threat is moderate-to-high among Parallels Desktop users on macOS. The privilege escalation from standard user to root represents critical impact for affected systems. This is not a low-real-risk issue despite requiring local access—any user with standard account access on a Mac running the vulnerable Parallels version can potentially become root.

An attacker with a standard macOS user account on a system running Parallels Desktop 20.1.1 monitors when snapshots are scheduled for deletion. The attacker creates a symbolic link in the snapshot storage directory (typically ~/.parallels/) pointing to a sensitive root-owned system file such as /etc/sudoers or a root-owned application binary. When the snapshot deletion routine executes with root privileges, it follows the symlink without validating it, transferring ownership of the target file to the attacker's user account. The attacker can then modify the file (e.g., edit /etc/sudoers to grant sudo access without password, or modify system binaries), achieving privilege escalation to root. The attack requires no user interaction and can be automated, making it a practical threat in shared or multi-user macOS environments. No public POC is documented in available sources, but the straightforward nature of symlink exploitation suggests one could be developed quickly.