Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-34854: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged c...

CVE-2021-34854 · published 5 years ago

Summary

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
parallels	parallels_desktop	16.1.3 `cpe:2.3:a:parallels:parallels_desktop:16.1.3:::::macos::`

Original advisory text

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13544.

References

https://kb.parallels.com/125013 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-937/ Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-789Memory Allocation with Excessive Size Value

CWE-770Allocation of Resources Without Limits

Timeline

Published25 Oct 2021

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-34854 · NVD

Track software like this

Free during beta