Description

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-14T10:17:06.133Z",
  "pubdate": "2026-09-14T10:17:06.133Z",
  "executiveSummary": "This vulnerability involves an improper command injection flaw within the prl_disp_service component of Parallels Desktop. The service operates with root privileges and exposes a world-writable Unix domain socket at /var/run/prl_disp_service.socket, allowing local, unprivileged users to communicate with the daemon.\nThe core of the issue lies in the insecure handling of user-supplied paths within the PrlSrv_InstallAppliance function, which ultimately leads to command injection during the execution of system-level tar operations. By manipulating the sVmParentPath argument to include shell metacharacters or quotes, an attacker can escape the intended command structure to execute arbitrary binaries with root privileges.\nThe vulnerability represents a critical security risk, as it allows any local user on the macOS system to gain full administrative control. Exploitation requires only local access to the system and the ability to interact with the service socket; no authentication or membership in administrative groups is required. This effectively bypasses standard macOS permission models, facilitating complete system compromise.",
  "technicalDetails": "The vulnerability originates in the prl_disp_service, a background daemon running with root privileges on macOS. This service listens on /var/run/prl_disp_service.socket, which is configured with world-writable permissions, allowing any local user to connect and issue inter-process communication (IPC) commands.\nThe exploitation flow begins with the PrlSrv_LoginLocal function, which accepts peer credentials but fails to perform sufficient verification, such as cryptographic signature validation or restrictive group membership checks, to gate access to sensitive administrative functions.\nOnce authenticated to the IPC channel, an attacker can invoke the PrlSrv_InstallAppliance function. This function accepts a user-provided string, sVmParentPath, which defines the destination directory for appliance unpacking. The service subsequently constructs a command line for the tar utility, formatted as 'tar -xf \"%1\" -C \"%2\"', where the second argument is the attacker-controlled path. This string is then passed to the Qt framework's QProcess::splitCommand function for parsing.\nThe vulnerability is triggered by the way QProcess::splitCommand parses the input string; it interprets quotes within the path as delimiters, allowing an attacker to prematurely close the directory string. Any text appended after the closing quote is treated as additional arguments to the tar command. By injecting flags such as --use-compress-program=, an attacker can force the tar process to execute an arbitrary binary of their choosing.\nBecause the prl_disp_service executes the constructed command string with root privileges, the injected program via the --use-compress-program parameter is also executed with root privileges. This grants the attacker a full root shell or the ability to modify critical system files, disable security controls, or install persistent backdoors. The lack of input sanitization on the sVmParentPath parameter allows for a straightforward injection attack, transforming a file operation into arbitrary code execution. As the daemon itself lacks robust verification of the environment or the parameters passed to the system shell, the execution of the arbitrary payload occurs without further obstruction, leading to total system compromise via local privilege escalation."
}