Protected file deletion via insecure temporary-directory cleanup

Insecure temporary-directory handling in PyInstaller before 5.13.1 allows local users to delete protected files through elevated Windows applications. The matplotlib and win32com runtime hooks create temporary directories with tempfile.mkdtemp, whose POSIX mode does not restrict access on Windows, and cleanup passes attacker-replaceable paths to shutil.rmtree. Exploitation requires an elevated bundled application, an attacker-accessible nondefault temporary directory, and either precise symlink timing or a Python 3.7.x-or-earlier junction.