CVE-2026-90894 Parallels CVE debrief

Who should care

System administrators and security teams responsible for managing Parallels Desktop installations should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

This vulnerability allows local attackers to potentially elevate privileges, access sensitive data, and requires verification of Parallels Desktop installations, additional monitoring, and logging.

• Potential elevation of privileges for local attackers
• Possible unauthorized access to sensitive data
• Required verification of Parallels Desktop installations
• Necessity for additional monitoring and logging

Technical summary

The vulnerability exists in the Parallels Desktop due to improper validation of user input when handling tar archives. The daemon runs as root and accepts peer credentials without proper validation. A local attacker can exploit this vulnerability to gain elevated privileges by providing a specially crafted appliance folder path. The vulnerability is caused by the use of a world-writable socket and the acceptance of peer credentials without proper validation. This allows local attackers to potentially elevate privileges and access sensitive data.

Defensive priority

High

Recommended defensive actions

• Review and restrict access to the /var/run/prl_disp_service.socket
• Verify and limit the appliance folder path
• Implement additional validation for user input
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability is caused by the use of a world-writable socket and the acceptance of peer credentials without proper validation. The daemon unpacks with one string, tar -xf '%1' -C '%2', then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.