Parsec for Windows runs a privileged daemon called parsecd.exe that relies on the AppData environment variable to locate configuration and resource files. If a local user sets this variable to an arbitrary path before the daemon starts, parsecd.exe will start with SYSTEM privileges while accepting untrusted user input. This incorrect use of privileged APIs (CWE‑648) allows an attacker to execute arbitrary code with full system rights, tamper with configuration, or install malware. The patch, available in Unity Parsec version 150‑104a, removes the ability for untrusted input to control the environment variable used by the daemon.

All Windows installations of Unity Parsec older than version 150‑104a are affected. Any instance of parsecd.exe running as NT AUTHORITY\SYSTEM on these systems can be exploited by a local user who can set the AppData environment variable before the daemon starts.

The CVSS score of 8.4 classifies this as a high‑severity vulnerability, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. The attack vector is local; a user can manipulate the environment variable and trigger parsecd.exe to elevate to SYSTEM, granting unrestricted access to the host.