ZDI-CAN-25039: ZDI-25-473: Parallels Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Published Jul 7, 2025

Updated

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2025-6812.

Affected Software

1 affected component

Parallels Client

Event History

Jul 7, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25039?

ZDI-CAN-25039 has a CVSS rating that indicates a potential for critical privilege escalation.

How do I fix ZDI-CAN-25039?

To mitigate ZDI-CAN-25039, update Parallels Client to the latest patched version.

Who is affected by ZDI-CAN-25039?

The vulnerability ZDI-CAN-25039 affects local users with low-privilege access on systems running Parallels Client.

What type of exploitation is possible with ZDI-CAN-25039?

ZDI-CAN-25039 allows local attackers to escalate their privileges on the affected systems.

What must an attacker do to exploit ZDI-CAN-25039?

An attacker must first execute low-privileged code on the target system to exploit ZDI-CAN-25039.