Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change the ownership of files owned by root to a lower-privilege user, potentially leading to privilege escalation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
csirt_it: ‼️ #ParallelsDesktop: Proof of Concept (#PoC) pubblici per le CVE-2024-54189, CVE-2025-31359, CVE-2024-52561 e CVE-2024-36486 Rischio: 🔴 ⚠ Ove non provveduto, si raccomanda l'applicazione delle mitigazioni disponibili https://x.com/csirt_it/status/2062847538370064690/photo/1 https://x.com/csirt_it/status/1930162468942123422
Post summary
Public PoCs for several CVEs are announced, with guidance to apply available mitigations.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | parallels | parallels_desktop | 20.1.1_\(55740\) | macos | - |