Microsoft PC Manager contains an improper link resolution flaw that allows an authorized local attacker to elevate privileges before file access. The vulnerability arises from following symbolic or junction links without proper validation, enabling an attacker to gain higher system privileges through local file access assays. The weakness corresponds to CWE-59 and is capable of increasing an attacker’s privilege level on the affected machine.

The product at risk is Microsoft PC Manager; no specific version information is disclosed. Any installation that has not received the latest official security update may be vulnerable.

The CVSS score of 7.8 classifies the flaw as high severity, yet the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The most likely attack vector requires a local user with the ability to run the application and create or manipulate links, and the impact is confined to the host where the application operates.