Protected file deletion via directory junction

Improper privilege management in Microsoft Windows Print Spooler allows local users to delete protected files through crafted print jobs. The service follows an attacker-controlled directory junction while processing a job sent to a FILE: port, redirecting a privileged file operation to another path. Low-privileged code execution on the host is required; deletion of a critical file can interrupt services or destabilize the system.