SYSTEM code execution via log-path symlink race

Privilege escalation in Microsoft Windows Installer on affected Windows releases allows local users to execute code as SYSTEM. During an MSI repair with logging, the service checks an attacker-controlled log path while impersonating the user, then reopens it as LocalSystem after a symlink swap and writes attacker-influenced terminal properties. A low-privileged local account and a repairable cached MSI package are required; injected PowerShell profile content executes with elevated rights when an administrator or scheduled task starts PowerShell.