CVE-2023-37250

HighCVSS 7.0

Published: 20/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Unity Parsec has a TOCTOU race condition that allows local attackers to escalate privileges to SYSTEM if Parsec was installed in 'Per User' mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs.

Risk Assessment

Privilege escalation to SYSTEM level can lead to serious security breaches, allowing attackers full control over the system. Organizations should be aware of the risks associated with using the vulnerable version of the software.

Recommendation

It is recommended to upgrade to Parsec Loader version 9, which includes fixes that eliminate this vulnerability. A system audit should also be conducted to identify and mitigate potential threats.

Other vulnerabilities in Unity Parsec

CVE-2026-54424High
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.

Original NVD description (English source)

Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.