Parallels Desktop is vulnerable to a Local Privilege Escalation via Appliance Extract Argument Injection
Parallels Desktop for Mac
< 27.0.1
Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.
After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
I got a root shell on 26.4.0 (57513). 27.0.1 starts tar as a fixed argv list, so the same quote stays a folder name and does not run code. Hosts that stay on the 26.x line, including 26.4.2, do not have that extract change.
Step 1 - Confirm the build and the dispatcher socket
defaults read "/Applications/Parallels Desktop.app/Contents/Info" CFBundleShortVersionString
ls -l /var/run/prl_disp_service.socket
Expected output on a vulnerable host:
26.4.0
srwxrwxrwx 1 root daemon 0 ... /var/run/prl_disp_service.socket
Step 2 - Log in as a non-admin user
From an unsigned process, call PrlSrv_LoginLocal against the dispatcher, then read PrlUsrCfg_IsLocalAdministrator. The login returns 0. The administrator flag stays 0.
Step 3 - Install an appliance into a quote-breaking folder
Build a small tar and set PackageURL to a file:// path with a matching PackageMd5. Pass sVmParentPath as a real directory whose name embeds a quote and a tar flag:
/tmp/sprl_p_<uid>" --use-compress-program=/tmp/u<uid> "
Call PrlSrv_InstallAppliance. On 26.4.0, QProcess::splitCommand turns the text after the quote into extra argv. macOS tar then runs /tmp/u
Step 4 - Check the result
On 26.4.0 the named program runs as uid 0. InstallAppliance may return -41508 after extract. That is expected. Proof is the root marker, not the job status.
On 27.0.1 the same folder name is created on disk as a directory. It does not become tar flags. Root does not run the script.
Upgrade to Parallels Desktop 27.0.1 or later.
Until every host is on 27.0.1 or later, restrict local login on those Macs. Any local account on a vulnerable install can reach the dispatcher socket.
https://www.cve.org/CVERecord?id=CVE-2026-90894 https://kb.parallels.com/en/131168 https://www.parallels.com/products/desktop/