SYSTEM escalation via updater directory-junction race

Privilege escalation in Firefox before 97, Firefox ESR before 91.6, and Thunderbird before 91.6 allows local users to gain SYSTEM access. The Windows Maintenance Service checks and locks an update subdirectory, but a racing process can replace it with a directory junction before recursive permission repair grants the Users group full control over the junction target. Successful exploitation requires local code execution and precise junction swaps during the update-permission race; changing the service directory permits replacement of its executable and subsequent SYSTEM execution.