Privilege escalation via Print Spooler link following

Privilege escalation in Microsoft Windows Print Spooler allows local users to escape a low-integrity sandbox and run code at medium integrity. The service follows attacker-controlled links when creating a file, allowing a low-privileged process to place an arbitrary file outside its sandbox. Exploitation requires prior low-privileged code execution on the target; resulting code retains the current user's identity but gains medium integrity.