Local privilege escalation via symbolic-link race

Privilege escalation in McAfee Endpoint Security for Windows 10.x before 10.7.0 April 2020 Update allows local users to create or delete files. During an antivirus scan, the product follows an attacker-altered symbolic-link target when performing privileged file operations, creating or deleting the linked file instead of the scanned path. Exploitation requires local low-privileged access and winning a timing-dependent race while an antivirus scan is in progress; the reported consequence is unauthorized file creation or deletion.