The vulnerability arises from improper link resolution before file access, allowing a user to force the operating system to follow symbolic links that point to files or directories they should not be able to access. This flaw, categorized as CWE‑59, can let a local account read or modify protected data and ultimately gain higher privileges on the affected system.

Citrix UniconOS releases prior to 2607 CR and prior to 2603 LTSR CU2 are affected. The operating systems lack the checks required to prevent link following when file permissions are insufficient, leaving them open to local privilege escalation.

The CVSS score of 8.5 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because it requires local access, the attack vector is likely local. A local user can create a malicious link to a protected resource and exploit the flaw, achieving privilege escalation without remote access. The overall risk remains high for any environment where local users can manipulate filesystem links.