Improper link resolution before file access in the quarantine restoration process of WatchDog Anti‑Virus 1.8.640 on Windows allows a local, low‑privileged attacker to cause a quarantined file to be written to an arbitrary location by creating a directory junction at the original path and convincing an administrator to restore the file. This can modify protected files or enable SYSTEM‑level code execution through DLL hijacking.

WatchDog Anti‑Virus 1.8.640 on Windows is affected. The vulnerability is specific to that version of the product.

The CVSS score is 5.2, indicating moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. The attack requires local access and low privilege on the target machine, but it can be leveraged by an attacker who can persuade an administrator to restore a file. Once the file is written to an arbitrary location, privileged execution may follow if a DLL hijack or similar mechanism is triggered. Overall risk is moderate, with exploitation unlikely to be automated without administrator cooperation.