Administrator escalation via privileged file replacement

Privilege escalation in TightVNC before 2.8.75 allows remote authenticated users to gain Administrator access through file transfer. The Windows server's privileged backend lets the file-transfer handler delete or overwrite executables in protected locations without reauthentication. A valid VNC password and user interaction to launch the planted executable or restart the host are required; successful exploitation executes attacker-controlled code with Administrator privileges.