Dell Encryption CVE-2025-46637

Exploitation requires an already-authenticated local user on a system running Dell Encryption at a version prior to 11.12.1, plus user interaction (UI:R) to trigger the privileged file operation that follows the attacker-planted link. Limiting factors: there is no remote vector (AV:L), the attacker needs valid local credentials (PR:L), and the UI:R requirement means a privileged Encryption operation must be invoked rather than firing autonomously. These constraints confine the threat to insiders or to post-compromise escalation on an endpoint where Dell Encryption is deployed.

This is a locally-exploitable privilege-escalation flaw that should be triaged as a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R) confirms the attacker must already have local, authenticated access (PR:L) and requires user interaction (UI:R), which meaningfully constrains exploitability despite the high C:H/I:H/A:H impact that produces the 7.3 base score. All opportunistic-exploitation signals are low and mutually consistent: EPSS is 0.10% (1st percentile), the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The one notable conflict is in the metadata rather than the risk signals: the CVE is tagged 'Information Disclosure' but the Dell description and CWE-59 ('Link Following') describe an Elevation of Privilege primitive - treat this as a local EoP, not a disclosure bug. Net: a legitimate patch-management item for environments running Dell Encryption, but it is a high-CVSS-local flaw with low real-world exploitation pressure, not an emergency.

A local authenticated user on a workstation running Dell Encryption plants a malicious symbolic link (or junction) at a path the privileged Encryption service accesses, then triggers the required user interaction so the service follows the link and operates on an attacker-chosen file with elevated privileges. Because the vector is local and requires an interaction step (AV:L, UI:R), this is a hands-on-keyboard local escalation rather than a remote mass-exploitation scenario. No public proof-of-concept is referenced at time of analysis.