Parallels Desktop for Mac runs the prl_disp_service daemon as root, which listens on a world-writable socket. Local clients can authenticate without signature or admin group restrictions. The vulnerability arises in the PrlSrv_InstallAppliance function, which unpacks an appliance folder by constructing a shell command: tar -xf "%1" -C "%2". The command string is split by Qt's QProcess::splitCommand, but if the folder name contains a quote, it prematurely closes the quoted string, allowing leftover text to be interpreted as additional tar flags. Since macOS tar supports --use-compress-program=, an attacker can specify an arbitrary program to run as root, leading to command injection.

Successful exploitation allows a local attacker with access to the prl_disp_service socket to execute arbitrary commands as root on the host system. This results in full system compromise with confidentiality, integrity, and availability impacts rated high.

No official patch or fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the prl_disp_service socket and avoid running untrusted appliance folders. Monitor vendor communications for updates.