Privilege Escalation in Parallels Desktop by Parallels

CVE-2021-34986

What is CVE-2021-34986?

This vulnerability enables local attackers to escalate their privileges on installations of Parallels Desktop 16.5.0 (49183). To exploit this flaw, an attacker must first have the ability to execute low-privileged code on the targeted system. The weakness specifically resides in the Parallels Service, allowing an adversary to create a symbolic link that can be abused to execute arbitrary files. By exploiting this vulnerability, attackers could potentially elevate their privileges to root, leading to the execution of arbitrary code. This poses significant risks to the affected systems, making it critical for users to apply necessary patches and updates.

References