ZDI-CAN-21260: ZDI-23-1804: Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parallels Desktop. User interaction is required to exploit this vulnerability in that the target in a guest system must visit a malicious page or open a malicious file. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the hypervisor.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parallels Desktop. User interaction is required to exploit this vulnerability in that the target in a guest system must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.3. The following CVEs are assigned: CVE-2023-50227.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-21260?
ZDI-CAN-21260 has a high severity rating due to its potential for remote code execution.
How do I fix ZDI-CAN-21260?
To fix ZDI-CAN-21260, users should apply the latest security updates provided by Parallels for Desktop.
Who is affected by ZDI-CAN-21260?
ZDI-CAN-21260 affects installations of Parallels Desktop for Mac.
What are the prerequisites for exploiting ZDI-CAN-21260?
Exploitation of ZDI-CAN-21260 requires user interaction, such as visiting a malicious webpage or opening a harmful file in a guest system.
Can ZDI-CAN-21260 affect my system without any action on my part?
No, ZDI-CAN-21260 cannot affect your system without user interaction.