EUVD-2026-30934
GHSA-3phm-wpxf-97gh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Scope is Changed because exploitation crosses the low-privilege to Administrator boundary; Integrity is High given arbitrary elevated file write; Confidentiality and Availability are Limited.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.
AnalysisAI
Symbolic link exploitation in Portrait Dell Color Management (before 3.7.0) on Windows allows a local low-privileged user to escalate privileges to Administrator by redirecting an elevated installer file write to an arbitrary system path. During installation, the software writes CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ with Administrator-level privileges while failing to validate symlinks or reparse points at the destination - an attacker who pre-stages a malicious junction or symlink at that path gains arbitrary file creation or overwrite capability under the elevated context. No public exploit code has been identified at time of analysis; SSVC signals confirm no known active exploitation.
Technical ContextAI
The vulnerability is rooted in CWE-59 (Improper Link Resolution Before File Access), a classic Windows installer privilege escalation pattern. The affected component is Portrait Displays' color calibration software bundled with Dell monitor drivers. During the installation phase, the process runs with elevated (SYSTEM or Administrator) privileges and writes a data file (CCFLFamily_07Feb11.edr) to a user-writable intermediate path under C:\ProgramData. Because ProgramData subdirectories can often be manipulated by standard users prior to installer execution, an attacker can replace the target directory with a Windows junction point or NTFS symbolic link pointing to a privileged system location (e.g., C:\Windows\System32). The installer then resolves the reparse point and writes the file under its elevated token to the attacker-chosen destination. CPE data from NVD is listed as n/a, which limits version-range precision to what the vendor advisory describes: all versions prior to 3.7.0.
RemediationAI
Upgrade Portrait Dell Color Management to version 3.7.0 or later, as documented in the vendor security advisory at https://www.portrait.com/dell-security-cve-updates/. If immediate patching is not possible, a targeted compensating control is to pre-create the directory C:\ProgramData\Portrait Displays\CW\data\i1D3\ with restrictive NTFS ACLs that deny standard users the ability to delete or replace it with a junction point - this blocks the attack setup without disabling the software, though it must be reapplied after any reinstallation. Blocking standard users from creating junction points system-wide (via group policy or filesystem restrictions) reduces risk across a broader class of symlink attacks but may affect other legitimate software. Restricting software installation to privileged accounts via AppLocker or Software Restriction Policies eliminates the installation-time exposure but requires operational process changes.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today