CVE-2026-54424

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/tomadimitrie/CVE-2026-54424
https://parsec.app/
https://support.parsec.app/hc/en-us/articles/50612943726612-CVE-2026-54424
https://www.tomadimitrie.dev/blog/CVE-2026-54424

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de uso incorrecto de APIs privilegiadas en Unity Parsec en hosts de Windows conduce a una potencial Elevación de Privilegios. Este problema afecta a Parsec hasta la v2026-05-04.0. La versión parcheada es Parsec para Windows versión 150-104a. Un usuario puede generar una situación en la que hay una instancia de parsecd.exe ejecutándose como NT AUTHORITY\SYSTEM con un valor controlado por el usuario de la variable de entorno AppData.

Information

Published : 2026-07-04 01:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-54424

Mitre link : CVE-2026-54424

CVE.ORG link : CVE-2026-54424

JSON object : View

Products Affected

No product.

CWE

CWE-648

Incorrect Use of Privileged APIs

{"id": "CVE-2026-54424", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54424", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-06T15:34:43.819706Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Unity", "product": "Parsec", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "v2026-05-04.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-07-04T01:16:27.340", "references": [{"url": "https://github.com/tomadimitrie/CVE-2026-54424", "source": "cve@mitre.org"}, {"url": "https://parsec.app/", "source": "cve@mitre.org"}, {"url": "https://support.parsec.app/hc/en-us/articles/50612943726612-CVE-2026-54424", "source": "cve@mitre.org"}, {"url": "https://www.tomadimitrie.dev/blog/CVE-2026-54424", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-648"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is\u00a0Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\\SYSTEM with a user-controlled value of the AppData environment variable."}, {"lang": "es", "value": "Una vulnerabilidad de uso incorrecto de APIs privilegiadas en Unity Parsec en hosts de Windows conduce a una potencial Elevaci\u00f3n de Privilegios. Este problema afecta a Parsec hasta la v2026-05-04.0. La versi\u00f3n parcheada es Parsec para Windows versi\u00f3n 150-104a. Un usuario puede generar una situaci\u00f3n en la que hay una instancia de parsecd.exe ejecut\u00e1ndose como NT AUTHORITY\\SYSTEM con un valor controlado por el usuario de la variable de entorno AppData."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "cve@mitre.org"}