Parallels Desktop EUVD-2025-16718

CVSS 3.1 score of 8.8 (High severity) reflects accurate risk: Attack Vector Local (AV:L), Attack Complexity Low (AC:L), Privileges Required Low (PR:L), User Interaction None (UI:N), and Scope Changed (S:C) with complete impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H). The changed scope indicates the vulnerability can affect other users/system components beyond the vulnerable application. Real-world risk is substantial: (1) it requires local access but only low privileges, making it exploitable by any standard user; (2) no user interaction needed reduces exploitation friction; (3) the ability to write arbitrary files combined with privilege escalation potential makes this a lateral privilege escalation vector; (4) in enterprise deployments or shared Mac systems, this poses significant risk. Without access to EPSS data, KEV/CISA status, or POC availability from provided references, the CVSS vector alone indicates this should be prioritized for patching—it is not an inflated CVSS case but a genuine local privilege escalation threat.

An unprivileged local user on a Mac system running Parallels Desktop 20.2.2 crafts a malicious PVMP file containing path traversal sequences (e.g., '../../../../etc/sudoers.d/malicious'). The user triggers the PVMP unpacking mechanism via the Parallels UI or a script. The vulnerable unpacking code fails to sanitize the file path and extracts the malicious payload to /etc/sudoers.d/, granting the attacker sudo privileges without a password. The attacker then escalates to root, achieving full system compromise. Alternatively, the attacker writes to a LaunchAgent plist in ~/Library/LaunchAgents/ to establish persistence. Because Attack Complexity is Low and User Interaction is None, the exploit is reliable and requires minimal attacker sophistication once a PVMP is crafted. The low Privileges Required barrier means any user with a standard account can attempt this attack.