The vulnerability resides in the optimization module of Intego Antivirus for Windows. A link‑following flaw allows a local unprivileged user to delete arbitrary folders owned by SYSTEM. Attackers can replace a scanned duplicate file’s directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute arbitrary code as SYSTEM. This raises the attacker’s privilege to SYSTEM, enabling full control of the affected machine. The weakness maps to CWE‑59, indicating a path traversal or symlink abuse.

Intego Antivirus for Windows is affected. The issue appears in all releases up to version 3.0.0.1. No other product or higher version is listed as affected.

The CVSS score of 8.5 reflects a high severity for local privilege escalation. EPSS data are not available, but the absence of a known KEV listing does not diminish the risk to organizations running the vulnerable version. The attack requires local, unprivileged access and the ability to trigger the antivirus optimisation process. Based on the description, it is inferred that the attacker needs local user rights and the ability to create a malicious duplicate file that the antivirus rescans, followed by the creation of a junction to C:\Config.msi to trigger a rollback of a Windows Installer session, which then runs at SYSTEM. Because the exploit chain relies on local filesystem manipulation, it is less likely to be executed remotely but can be automated once a user runs the client.