CVE-2024-34331

CVE-2024-34331 is a critical privilege escalation vulnerability in Parallels Desktop for Mac versions 19.3.0 and below, stemming from a lack of code signature verification. This flaw allows an unauthenticated attacker to achieve root privileges on the host macOS system by providing a specially crafted macOS installer, leveraging the setuid root permissions of Parallels Service. With a CVSS score of 9.8 (CRITICAL) and a FAUCET Risk Score of 92/100, the vulnerability poses a significant threat due to its network-based attack vector and high impact on confidentiality, integrity, and availability. While a patch exists, public exploit code has been demonstrated, and there is active community discussion and media coverage, indicating a high potential for exploitation, though it is not yet listed in CISA's KEV catalog.