CVE-2023-37250

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250Third Party Advisory
https://unity3d.comProduct
https://www.kb.cert.org/vuls/id/287122Third Party Advisory, US Government Resource
https://support.parsec.app/hc/en-us/articles/18311425588237-CVE-2023-37250Third Party Advisory
https://unity3d.comProduct
https://www.kb.cert.org/vuls/id/287122Third Party Advisory, US Government Resource

Timeline

Published: Aug 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-372516.1An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function do CVE-2023-372523.1An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.CVE-2023-372533.1An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the AP CVE-2023-372546.1An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item whe CVE-2023-372556.1An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vu CVE-2023-372566.1An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and auto CVE-2023-372575.4DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, the DataEase panel and dataset have a stored cross-sit CVE-2023-372589.8DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can by CVE-2023-372595.4matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain atta CVE-2023-37266.9OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.CVE-2023-372607.5league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to versio CVE-2023-372618.8OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers