Local privilege escalation via roaming token path traversal

Windows Credential Roaming Service in Microsoft Windows before the listed security builds allows remote authenticated users to gain elevated execution via crafted Active Directory credential data. The dimsroam.dll component appends an attacker-controlled roaming-token identifier to a local path without sanitizing traversal sequences, letting a controlled msPKIAccountCredentials entry write arbitrary files. Exploitation requires write access to a victim Active Directory account and Credential Roaming enabled; the file can execute in the victim user context at logon and support privilege escalation.