SYSTEM file write via raced configuration validation

A TOCTOU race in AWS Client VPN for Windows 2.0.0 and earlier allows local users to write partially controlled files as SYSTEM. The client validates an OpenVPN configuration, then lets its SYSTEM service process the same mutable file, allowing replacement of approved content with a disallowed log directive that selects an arbitrary destination. Exploitation requires existing local code execution and file access; the privileged write enables elevation of privilege or an unspecified service interruption.