CVE-2020-17400 is a local privilege escalation vulnerability affecting Parallels Desktop 15.1.4, specifically within the prl_hypervisor kext. The flaw stems from insufficient validation of user-supplied data, leading to a read past the end of a buffer. This allows an attacker with low-privileged code execution to escalate privileges and execute code within the hypervisor's context. Rated with a CVSS score of 8.8 (High), this vulnerability has a local attack vector and low attack complexity, with no user interaction required. Successful exploitation grants high confidentiality, integrity, and availability impacts. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community attention and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 16.0.0CPE matchmatch criteria | cpe:2.3:a:parallels:parallels_desktop:*:*:*:*:*:macos:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.