Local privilege escalation via predictable junction target

Link-following in WIBU-SYSTEMS AG CodeMeter Runtime allows local users to delete arbitrary files with System privileges. The cmu.exe --create-io --file C: path creates a predictable temporary file under C:\CM-Stick and performs file operations without rejecting NTFS junctions or symbolic links. A low-privileged Windows account that can invoke cmu.exe and place the reparse point can redirect the privileged deletion to an arbitrary system path, enabling local privilege escalation.