SYSTEM privilege escalation via interactive MSI repair console

Privilege escalation in Palo Alto Networks GlobalProtect App on Windows allows local users to gain SYSTEM access through MSI repair. The MSI repair path runs PanVCrediChecker.exe as SYSTEM and opens an interactive conhost.exe window while reading libeay32.dll. A non-administrative user with GUI access can hold the DLL read with an opportunistic lock, keep that privileged console open, and launch cmd.exe as SYSTEM; no special configuration is required.