Root code execution via Updater symlink move

Local privilege escalation in Parallels Desktop before 18.3.2 allows local users to execute arbitrary code as root through the Updater service. The service follows an attacker-created symbolic link while moving files, permitting a low-privileged process to redirect an arbitrary file move. Exploitation requires prior ability to run low-privileged code on the macOS host; the resulting file operation enables execution in the root context.