Privilege escalation via config path resolution

Privilege escalation in Microsoft PowerShell before 7.4.19, 7.5.10, and 7.6.5 allows local users to gain elevated privileges via incorrect default permissions. Microsoft has not published a full root-cause narrative, but the linked PowerShell servicing change fixes local-user config path resolution for the SYSTEM account, uses DoNotVerify with Environment.GetFolderPath, and skips per-user config loading when the derived path is empty. Exploitation is local and requires an authenticated context plus user interaction, so triage should focus on hosts where higher-privileged PowerShell sessions can be induced to consult attacker-influenced user configuration paths.