Skip to content
OpenAdvisories
High · 7.8 CVE-2024-36486 EUVD-2024-54643GHSA-w3cx-68mp-rwcw

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 2…

Published Jun 3, 2025 · Updated Jun 3, 2025 · Assigned by talos

Description

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.

Affected products

VendorProductAffectedFixed
Parallels Parallels Desktop for Mac version 20.1.1 (55740) —

References