SYSTEM code execution via directory junction abuse

Privilege escalation in Microsoft Windows Update Stack allows local users to execute code as SYSTEM through Windows Setup. Windows Setup follows an attacker-created directory junction and creates a file at an attacker-selected location instead of confining the write to its intended directory. Exploitation requires prior low-privileged code execution on the target, after which the arbitrary privileged file write grants SYSTEM-context execution.