Parallels Desktop For Mac
Monthly
Privilege escalation to root in Parallels Desktop for Mac via argument injection into a tar command executed by the root-owned dispatcher service. Any local user - no admin rights required - can connect to the world-writable `/var/run/prl_disp_service.socket`, authenticate via `PrlSrv_LoginLocal` without signature verification, and then pass a crafted appliance path through `PrlSrv_InstallAppliance` that embeds a quote character to escape the Qt `QProcess::splitCommand` argument boundary, injecting `--use-compress-program=<binary>` into macOS tar and running arbitrary code as root. No public exploit has been identified at time of analysis, but the exploitation path requires no special conditions beyond a local user account.
Privilege escalation to root in Parallels Desktop for Mac via argument injection into a tar command executed by the root-owned dispatcher service. Any local user - no admin rights required - can connect to the world-writable `/var/run/prl_disp_service.socket`, authenticate via `PrlSrv_LoginLocal` without signature verification, and then pass a crafted appliance path through `PrlSrv_InstallAppliance` that embeds a quote character to escape the Qt `QProcess::splitCommand` argument boundary, injecting `--use-compress-program=<binary>` into macOS tar and running arbitrary code as root. No public exploit has been identified at time of analysis, but the exploitation path requires no special conditions beyond a local user account.