This vulnerability occurs in the RAS RDP Backend Service of Parallels RAS Client. A locally exposed dangerous function allows an attacker who can already run low‑privileged code on the system to elevate privileges to the SYSTEM level and execute arbitrary code. The weakness is identified as CWE‑749 (Exposed Dangerous Function).

The flaw affects installations of the Parallels RAS Client that include the RAS RDP Backend Service. No specific version numbers are provided, so all current installations that have not yet applied a vendor patch are potentially vulnerable.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. Attackers would first need to obtain local low‑privileged code execution on the target machine. Once achieved, they can invoke the exposed function to gain SYSTEM privileges. The risk is significant for environments where local users already have some code execution capabilities, as it enables full system compromise.