CVE-2024-36486
Parallels Desktop 20.1.1_\(55740\)
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-36486 is a high-severity UNIX Hard Link (CWE-62) vulnerability in Parallels Parallels Desktop. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54643
Vulnerability Data
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its…
more
original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops operations on files reached via unauthorized hard links by checking the actual target resource against authorizations.
Least privilege reduces the set of files an attacker can affect even if a hard-link name is resolved outside the intended sphere.
Information flow enforcement can block unintended data access that occurs when a hard link crosses control-sphere boundaries.
Preventing unintended transfer via shared resources (inodes) structurally blocks the effect of hard links that alias files across spheres.
Validating file-name inputs can reject or canonicalize names that resolve to links before access occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege permissions and authorization checks directly prevents operations on files reached via unauthorized hard links.
Secure-development practices include safe file-open and link-handling routines that eliminate the described weakness.
Logical-access protections reduce the attack surface for hard-link traversal but do not address the coding flaw itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover hard-link issues but does not itself prevent them in production.
Secure SDLC practices can mandate link-resolution checks and canonicalization before file access.
Application security requirements can explicitly require safe handling of symbolic links and path traversal.
Secure architecture principles include proper file-system namespace handling that can prevent hard-link traversal.
Secure-coding practices can mandate safe file-open APIs and link validation, directly addressing the weakness.
Access-control rules can restrict which files a process may open, reducing the chance of following unauthorized hard links.