CVE-2024-54189
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.32%
- CWE
- CWE-62
- Published
- 2025-06-03
- Last modified
- 2026-03-13
Affected products
- Parallels Parallels Desktop for Mac
Weakness type
Related vulnerabilities
- CVE-2026-32232 — ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
- CVE-2024-36486 — A privilege escalation vulnerability exists in the virtual machine archive restoration...