SYSTEM code execution via directory junction deletion

Privilege escalation in Microsoft Windows User Profile Service allows local users to execute code as SYSTEM through a directory junction. The service follows an attacker-created directory junction when deleting a file, redirecting its privileged deletion to an attacker-chosen path. Low-privileged code execution on the target is required, and successful exploitation grants SYSTEM-level code execution.