EUVD-2026-30934
GHSA-3phm-wpxf-97gh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Scope is Changed because exploitation crosses the low-privilege to Administrator boundary; Integrity is High given arbitrary elevated file write; Confidentiality and Availability are Limited.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.
AnalysisAI
Symbolic link exploitation in Portrait Dell Color Management (before 3.7.0) on Windows allows a local low-privileged user to escalate privileges to Administrator by redirecting an elevated installer file write to an arbitrary system path. During installation, the software writes CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ with Administrator-level privileges while failing to validate symlinks or reparse points at the destination - an attacker who pre-stages a malicious junction or symlink at that path gains arbitrary file creation or overwrite capability under the elevated context. No public exploit code has been identified at time of analysis; SSVC signals confirm no known active exploitation.
Technical ContextAI
The vulnerability is rooted in CWE-59 (Improper Link Resolution Before File Access), a classic Windows installer privilege escalation pattern. The affected component is Portrait Displays' color calibration software bundled with Dell monitor drivers. During the installation phase, the process runs with elevated (SYSTEM or Administrator) privileges and writes a data file (CCFLFamily_07Feb11.edr) to a user-writable intermediate path under C:\ProgramData. Because ProgramData subdirectories can often be manipulated by standard users prior to installer execution, an attacker can replace the target directory with a Windows junction point or NTFS symbolic link pointing to a privileged system location (e.g., C:\Windows\System32). The installer then resolves the reparse point and writes the file under its elevated token to the attacker-chosen destination. CPE data from NVD is listed as n/a, which limits version-range precision to what the vendor advisory describes: all versions prior to 3.7.0.
RemediationAI
Upgrade Portrait Dell Color Management to version 3.7.0 or later, as documented in the vendor security advisory at https://www.portrait.com/dell-security-cve-updates/. If immediate patching is not possible, a targeted compensating control is to pre-create the directory C:\ProgramData\Portrait Displays\CW\data\i1D3\ with restrictive NTFS ACLs that deny standard users the ability to delete or replace it with a junction point - this blocks the attack setup without disabling the software, though it must be reapplied after any reinstallation. Blocking standard users from creating junction points system-wide (via group policy or filesystem restrictions) reduces risk across a broader class of symlink attacks but may affect other legitimate software. Restricting software installation to privileged accounts via AppLocker or Software Restriction Policies eliminates the installation-time exposure but requires operational process changes.
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p
go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today