Researchers have publicly disclosed two (2) distinct exploits that take advantage of an unpatched privilege escalation vulnerability in Parallels Desktop, a virtualization software for Mac. The vulnerability, tracked as CVE-2024-34331, was originally patched in September 2024, but still remains exploitable due to bypass techniques discovered by security researcher Mickey Jin. The first exploit employs a time-of-check to time-of-use (TOCTOU) attack that tricks the system by replacing an Apple-signed “createinstallmedia” binary with a maliciously crafted one after its signature is verified. The second exploit targets the “do_repack_manual” function, using symlink manipulation to redirect file writes and overwrite critical root-owned files, thereby enabling attackers to execute code with root privileges. Despite initial disclosure and Jin’s notification in June 2024, Parallels has not adequately addressed the issue, leaving all known versions from 19.4.0 and older up to the latest release (20.2.1) vulnerable to exploitation. Until Parallels issues an official patch, CTIX analysts advise users to exercise heightened caution with their systems. Since all known versions of Parallels Desktop are vulnerable to at least one of the exploits, it’s advisable to avoid running untrusted or suspicious code that could trigger the privilege escalation flaw. Using a non-administrative account for daily tasks may help reduce the impact of any potential compromise. Additionally, users should closely monitor official communications from Parallels for any security updates or patches and consider temporarily uninstalling or disabling Parallels Desktop if it isn’t essential to their workflow. Regular system backups and maintaining overall macOS security hygiene can also help mitigate risks in the meantime.