CVE-2023-50227— Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-50227
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Parallels Desktop. User interaction is required to exploit this vulnerability in that the target in a guest system must visit a malicious page or open a malicious file. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the hypervisor. . Was ZDI-CAN-21260.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存写
Source: NVD (National Vulnerability Database)
Vulnerability Title
Corel Parallels Desktop 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Corel Parallels Desktop是加拿大科亿尔数码科技（Corel）公司的一套适用于macOS平台的虚拟机软件。 Corel Parallels Desktop 存在安全漏洞，该漏洞源于 virtio-gpu 虚拟设备中存在特定缺陷，缺乏对用户提供的数据进行正确验证，攻击者利用该漏洞可以在虚拟机管理程序上下文中执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-50227
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-50227
请登录查看更多情报信息。
- ZDI-23-1804 | Zero Day Initiativex_research-advisory
- https://kb.parallels.com/en/125013vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-50227
Same Patch Batch · Parallels · 2024-05-03 · 10 CVEs total
| CVE-2023-27328 | Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability | |
| CVE-2023-27324 | Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability | |
| CVE-2023-27326 | Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability | |
| CVE-2023-27327 | Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerabil | |
| CVE-2023-27325 | Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability | |
| CVE-2023-27323 | Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerabili | |
| CVE-2023-27322 | Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability | |
| CVE-2023-50228 | Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege | |
| CVE-2023-50226 | Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability |
IV. Related Vulnerabilities
Same product: Desktop
- CVE-2026-7701
Telegram Desktop Bot API url_auth_box.cpp RequestButton null - CVE-2025-14414
Soda PDF Desktop Word File Insufficient UI Warning Remote Co - CVE-2025-14415
Soda PDF Desktop Launch Insufficient UI Warning Remote Code - CVE-2025-14413
Soda PDF Desktop CBZ File Parsing Directory Traversal Remote - CVE-2025-14412
Soda PDF Desktop XLS File Insufficient UI Warning Remote Cod
V. Comments for CVE-2023-50227
No comments yet