Local privilege escalation via named pipe impersonation

Local privilege escalation in Bopsoft Listary 6 and earlier allows local users to impersonate a privileged user through a named pipe. The Listary service automatically connects to an attacker-created \.\pipe\Listary.listaryService endpoint without ensuring that the expected server owns it. Exploitation requires local low-privileged access and a privileged user to start a Listary session, after which the attacker can duplicate that user's token and assume the same security context.