Administrator code execution via fixed-path binary replacement

Local privilege escalation in VMware InstallBuilder before 21.6.0 allows local users to execute code through a Windows uninstaller race. The uninstaller copies itself to a fixed, access-unrestricted temporary path and then executes that path, allowing its copied binary to be replaced before launch. Exploitation requires prior access to monitor the temporary directory and an uninstaller launched with Administrator privileges; resulting code runs in that privileged security context.