CVE-2026-90894: Parallels Desktop local privilege escalation via appliance extract argument injection
Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group.
After login, PrlSrvInstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parallels Desktopto a version that resolves this vulnerability.Fixed in 27.0.1 - Compensating control
Limit access to the world-writable socket /var/run/prl_disp_service.socket so only trusted/local clients can reach it (e.g., via firewall/ACL/socket permissions).
Event History
Frequently Asked Questions
Who can reach the vulnerable service?
Local clients can reach prl_disp_service through the world-writable /var/run/prl_disp_service.socket. The service accepts local peer credentials and does not require a Parallels signature or membership in an administrator group.
What does an attacker need to control?
The attacker needs to invoke PrlSrv_InstallAppliance and choose an appliance folder path. A quote in that folder name can terminate the intended argument and cause remaining text to be interpreted as additional tar flags.
What is the resulting privilege impact?
The injected tar option can use macOS tar's --use-compress-program= behavior to run a named program. Because prl_disp_service runs as root, that program runs with root privileges.