Vasion Print Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 contain a CWE-59 (Improper Link Following) vulnerability in the PrinterInstallerClient components. The software creates files with SYSTEM privileges inside a directory controlled by the local user (C:\Users\%USER%\AppData\Local\Temp\). An attacker able to place symbolic links or influence filenames in this directory can cause the service to follow the link and write to arbitrary filesystem locations as SYSTEM. This leads to local privilege escalation by allowing an unprivileged user to overwrite or create files with SYSTEM privileges, potentially modifying configuration files or injecting malicious binaries. The vulnerability is confirmed remediated, but no specific patch version or date is provided.

Successful exploitation allows a local, unprivileged user to escalate privileges to SYSTEM by leveraging symbolic link attacks on temporary files. This can compromise system confidentiality, integrity, and availability by enabling modification of configuration files, replacement or injection of binaries, and other unauthorized actions at SYSTEM privilege level. The CVSS 4.0 score is 8.5 (high severity), reflecting the significant impact on system security.

The vulnerability has been confirmed remediated by the vendor, though the exact patch version or date is not specified. Users should ensure they are running Vasion Print Virtual Appliance Host version 25.1.102 or later and Application versions 25.1.1413 or later for Windows client deployments. Patch status is not yet confirmed with a specific version; therefore, verify with the vendor advisory for the latest remediation guidance before taking further action.