Privilege escalation via ATBroker link following

Link following in Windows Accessibility Infrastructure (ATBroker.exe) in Microsoft Windows allows local users to gain elevated privileges via crafted links. ATBroker.exe performs privileged file access after Windows resolves an attacker-controlled link or reparse point, so the broker can be redirected from the intended path to an attacker-chosen target. Exploitation requires local authenticated access and no user interaction; Microsoft has published the affected builds and flaw class, but not a deeper public root-cause analysis or public exploit artifact.