CVE-2023-37250

low-risk

Published 2023-08-20

Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.

Do I need to act?

0.11% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.0/10 High

LOCAL / HIGH complexity

Affected Products (1)

Parsec

Affected Vendors

Unity

References (6)

Third Party Advisory https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250

Product https://unity3d.com

Third Party Advisory https://www.kb.cert.org/vuls/id/287122

Third Party Advisory https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250

Product https://unity3d.com

Third Party Advisory https://www.kb.cert.org/vuls/id/287122

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal