Portrait Dell Color Management EUVD-2026-30934

Exploitation requires a local, authenticated Windows session with at least low-privileged (standard user) rights on the target machine. The attack window is specifically tied to the installation or update execution of Portrait Dell Color Management - the attacker must pre-stage the malicious junction or symlink at C:\ProgramData\Portrait Displays\CW\data\i1D3\ before the installer runs. This requires the attacker to have write access to the ProgramData path segment above the target directory, which is typically accessible to standard users on default Windows configurations. The exploit is not remotely triggerable and is not automatable (SSVC: Automatable: no) without a separate mechanism to initiate the installation. Limiting factors: requires local session, requires installation event to occur, requires write access to ProgramData prior to installation.

The official CVSS 3.1 score of 5.3 (Medium) appears to underweight the real-world impact: C:L/I:L/A:L with S:U does not reflect that successful exploitation yields arbitrary file write as Administrator, a capability that enables persistence, disabling of AV tools, or overwriting of security-relevant binaries. The Scope metric should arguably be Changed (S:C) given the privilege boundary crossing. EPSS at 0.02% (6th percentile) and SSVC Exploitation: none both signal no current active exploitation. Automatable: no further reduces near-term risk - this attack requires local access, knowledge of the write path, and timing around the installation event. Overall, this is a real and exploitable local privilege escalation on any Windows endpoint where this software is installed, but the threat is constrained to post-compromise insider or malware-assisted scenarios rather than remote or opportunistic attack. CVSS score and CPE data are incomplete per NVD; affected version floor is inferred solely from the vendor advisory.

A local attacker with a low-privileged Windows account identifies that Portrait Dell Color Management is scheduled for installation or update. Before the installer runs, the attacker deletes or manipulates the C:\ProgramData\Portrait Displays\CW\data\i1D3\ directory and replaces it with a junction point targeting C:\Windows\System32 or another privileged path. When the installer executes with elevated privileges, it follows the junction and writes CCFLFamily_07Feb11.edr to the target system directory, giving the attacker a file write primitive under the Administrator context - usable for DLL planting, overwriting executables, or disabling security tooling.