EUVD-2026-26269Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Local-only attack (AV:L), race condition required (AC:H), low-privilege account needed (PR:L); no confidentiality impact as the flaw enables write but not read of arbitrary files.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write
AnalysisAI
Arbitrary file write via symlink following in Dell/Alienware Purchased Apps (versions prior to 1.1.31.0) allows a local low-privileged attacker to redirect application file operations to unintended targets, potentially overwriting sensitive system files and causing integrity or availability damage. The high attack complexity (AC:H) indicates a race condition or precise timing requirement, limiting opportunistic exploitation. No active exploitation has been identified - SSVC assessment rates exploitation as none and the vulnerability is absent from CISA KEV - though successful exploitation could yield significant local impact.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access, or 'Link Following') describes a class of vulnerabilities where an application resolves a file path and begins an operation without verifying that the path has not been substituted with a symbolic or hard link pointing to an unintended target. In this case, Dell/Alienware Purchased Apps (CPE: cpe:2.3:a:dell:dell/alienware_purchased_apps:*:*:*:*:*:*:*:*) performs a file write operation on a path that a low-privileged attacker can manipulate by pre-positioning a symlink. Because the application likely runs with elevated privileges (system service or elevated installer context), the write operation is performed under those elevated credentials, causing the OS to follow the link and write to the attacker-designated target. The vulnerability class is well-understood and exploitable via classic TOCTOU (time-of-check to time-of-use) race conditions.
RemediationAI
The primary fix is upgrading Dell/Alienware Purchased Apps to version 1.1.31.0 or later, which resolves the improper link resolution behavior per Dell advisory DSA-2026-131 (https://www.dell.com/support/kbdoc/en-us/000438321/dsa-2026-131-security-update-for-dell-alienware-purchased-apps-for-an-improper-link-resolution-before-file-access-vulnerability). Where immediate patching is not possible, compensating controls include restricting local interactive logon rights on affected systems to trusted administrators only, which eliminates the low-privileged local attacker prerequisite. Additionally, enforcing Windows filesystem auditing on directories used by the application can surface symlink creation attempts. These controls reduce exposure but do not eliminate it - patch deployment remains the definitive remediation.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today