VulnerabilityAwaiting Analysis

CVE-2026-34883

On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator.

MEDIUM 5.3EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-59
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.