Parallels Desktop CVE-2026-90894 Grants Root via prl_disp_service Socket and tar Command Injection on Apple Silicon

The vulnerability sits in prl_disp_service, which listens on a socket open to all users and accepts PrlSrv_LoginLocal calls that trust only kernel-reported credentials. An attacker supplies a folder name containing a double quote to the unpack template, closing the quoted path early and injecting --use-compress-program to execute arbitrary code as root. JFrog demonstrated the chain on build 57513 without requiring a running VM or admin rights.

Intel Macs cannot install the reported fix in version 27, leaving them on the vulnerable code path indefinitely according to current release notes. Timeline discrepancies between JFrog's 1 September disclosure and Parallels' 25 August 27.0.0 notes indicate the vendor has not published a build-level mapping for the socket and template changes. No independent regression data covers older 26.x builds.

The pattern matches prior Parallels service exposures where background daemons running as root accepted unauthenticated local connections. Shared lab or developer machines with Homebrew or npm workloads become immediate targets, as the attack requires only code execution in a standard user context. Absence of a vendor advisory leaves downstream detection reliant on third-party socket and binary signature checks.

Parallels has not issued a CVE response or Intel-specific mitigation timeline. Users on unsupported hardware face a permanent exposure window unless the company backports the socket hardening and command sanitization.