Dell Encryption CVE-2025-46636

Requires the attacker to already have a local, low-privileged authenticated account (PR:L) on a host running Dell Encryption prior to version 11.12.1, plus the ability to create symbolic links/junctions on the filesystem. Exploitation further depends on user interaction (UI:R) - a privileged user or the Dell Encryption process must perform the file operation that follows the attacker-planted link; it cannot be triggered unattended. There is no network vector (AV:L), and default configurations are affected insofar as the vulnerable version is installed; the chief limiting factors are the need for prior local access and the required interaction/timing to win the link-following race.

This is a moderate-severity local privilege/integrity issue, not a high-priority remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R) confirms exploitation requires local access, an already-authenticated low-privileged account, AND victim user interaction - three independent barriers that sharply limit real-world exploitability. EPSS is effectively zero (0.09%, 0th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so all exploitation signals point to low near-term risk. The one notable signal is the high integrity and availability impact (C:N/I:H/A:H): a successful link-following attack can tamper with or destroy protected data despite the low privilege starting point. Note a metadata inconsistency: the CVE is tagged 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and the description states 'Information tampering' - this is an integrity issue, not disclosure. Treat as a standard-cadence patch item rather than an emergency.

A low-privileged user already logged onto a workstation running Dell Encryption plants a malicious symbolic link (or junction) at a path the privileged Dell Encryption process will later access. When a higher-privileged user or the product performs the triggering action (UI:R), the link is followed and the operation is redirected to tamper with or overwrite files the attacker could not otherwise modify. No public proof-of-concept exploit was identified at the time of analysis.