Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability

CVE-2023-27324

What is CVE-2023-27324?

A vulnerability in the Parallels Desktop Updater service permits local attackers to escalate their privileges, potentially allowing for arbitrary code execution with elevated privileges. The issue arises due to improper initialization of environment variables within the Updater service, which can be exploited if the attacker has already gained the ability to execute low-privileged code on the host system. This flaw could provide a pathway for unauthorized access to sensitive system resources, elevating the attacker's control over the affected installation.

References