CVE-2026-90894: Parallels Desktop Privilege Escalation Flaw

CVE-2026-90894 Overview

CVE-2026-90894 is a local privilege escalation vulnerability in Parallels Desktop for macOS. The prl_disp_service daemon runs as root and exposes a world-writable Unix domain socket at /var/run/prl_disp_service.socket. Any local user can authenticate to this socket without membership in an administrative group and without a Parallels code signature check.

Once authenticated, an attacker invokes PrlSrv_InstallAppliance with a crafted sVmParentPath value. The daemon builds a tar command using unsafe string concatenation, and Qt's QProcess::splitCommand reparses the result. This lets an attacker inject additional tar flags, including --use-compress-program=, which executes an arbitrary binary as root [CWE-78].

Critical Impact
Any local user on a macOS host with Parallels Desktop installed can execute arbitrary commands as root through the dispatcher service socket.

Affected Products

Parallels Desktop for macOS (prl_disp_service component)
Installations exposing /var/run/prl_disp_service.socket with world-writable permissions
macOS hosts where tar supports --use-compress-program=

Discovery Timeline

2026-09-14 - CVE-2026-90894 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90894

Vulnerability Analysis

The flaw combines weak access control with unsafe command construction. The dispatcher socket accepts peer credentials from any local user through PrlSrv_LoginLocal. There is no signature verification of the calling binary and no requirement for administrative group membership. This grants unprivileged users a session with a root-owned service.

After login, PrlSrv_InstallAppliance accepts an appliance folder path in the sVmParentPath parameter. The daemon assembles a shell-style command using the template tar -xf "%1" -C "%2" and passes it to Qt's QProcess::splitCommand. Qt's splitter reparses quoted strings but does not preserve the boundary between arguments and user data. An embedded quote in the folder name closes the quoted region early, and remaining characters are tokenized as additional tar arguments.

On macOS, BSD tar supports the --use-compress-program=<cmd> flag, which spawns the named program to decompress the archive. Because the daemon runs as root, the injected program inherits root privileges.

Root Cause

The root cause is OS command injection through improper neutralization of quote characters in a string later reparsed by QProcess::splitCommand. The daemon treats untrusted input as trusted shell tokens.

Attack Vector

An authenticated local attacker connects to /var/run/prl_disp_service.socket, calls PrlSrv_LoginLocal, and issues an InstallAppliance request. The attacker supplies an sVmParentPath containing a quote followed by --use-compress-program= pointing to an attacker-controlled binary. The daemon executes that binary as root during archive extraction.

For technical details, see the Parallels Knowledge Base Article.

Detection Methods for CVE-2026-90894

Indicators of Compromise

Unexpected child processes of prl_disp_service running as root, particularly shells, interpreters, or binaries under user-writable directories.
Connections to /var/run/prl_disp_service.socket originating from non-administrative user sessions.
tar invocations spawned by prl_disp_service containing --use-compress-program= or unusual flag ordering.
Appliance install requests with quote characters or shell metacharacters in the sVmParentPath field.

Detection Strategies

Monitor process ancestry on macOS endpoints for root-owned processes whose parent is prl_disp_service.
Enable macOS Endpoint Security Framework telemetry for ES_EVENT_TYPE_NOTIFY_EXEC and correlate on the Parallels dispatcher as parent.
Alert on any tar execution by the dispatcher that includes --use-compress-program, --checkpoint-action, or similar action-bearing flags.

Monitoring Recommendations

Audit local socket connections to /var/run/prl_disp_service.socket and record the connecting UID.
Track file writes into VM appliance directories from non-console user contexts.
Retain command-line arguments for all root-owned process executions on developer and QA fleets where Parallels is common.

How to Mitigate CVE-2026-90894

Immediate Actions Required

Upgrade Parallels Desktop to the fixed release listed on the vendor advisory as soon as it is available.
Restrict local user access on macOS hosts running Parallels Desktop, particularly shared build or lab systems.
Stop and disable the Parallels dispatcher on systems that do not actively use Parallels virtualization.

Patch Information

Refer to the Parallels Knowledge Base Article for the current patched build. Apply the vendor-supplied update, which is expected to remove the world-writable socket permissions, enforce signature or group checks in PrlSrv_LoginLocal, and pass tar arguments through an argv array rather than a reparsed string. Product information is available on the Parallels Desktop Product Page.

Workarounds

Tighten permissions on /var/run/prl_disp_service.socket so that only administrative users can connect, if operationally acceptable.
Remove or rename the local tar binary paths accessible to prl_disp_service, or block --use-compress-program execution using an EDR rule.
Prevent installation of appliances from untrusted paths by restricting write access to the VM parent directories used by Parallels.

bash

# Configuration example: inspect socket exposure and dispatcher process
ls -l /var/run/prl_disp_service.socket
sudo lsof -U | grep prl_disp_service
sudo launchctl list | grep -i parallels