Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines permits an attacker to elevate privileges over a network. The flaw allows manipulation of link resolution to gain elevated access, potentially compromising the host system and any services running on the affected VM.

Microsoft's VM Inspector for Azure Virtual Machines is the affected product. No specific version information is provided, so all releases of this tool are potentially vulnerable.

The CVSS score of 10 indicates a critical vulnerability. There is no EPSS data available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is described as occurring over a network, inferring that an unauthenticated or low‑privileged attacker with network reach to the VM Inspector service can exploit the link following flaw to gain higher privileges.