This vulnerability (CVE-2026-21517) affects Microsoft Windows App for Mac version 11.0.0 and is caused by improper link resolution before file access, categorized as CWE-59. It enables a local attacker with some level of authorization to elevate privileges by exploiting how symbolic or hard links are resolved before accessing files. The CVSS 3.1 base score is 4.7, reflecting a medium severity with local attack vector, high attack complexity, and low privileges required. Microsoft has published an official fix for this vulnerability, as detailed in their security advisory.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected system. This could allow the attacker to perform actions beyond their intended permissions, potentially compromising system integrity. There is no impact on confidentiality or availability reported. No known exploits are currently active in the wild.

Microsoft has released an official fix for CVE-2026-21517. Users and administrators should apply the provided security update from the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21517 to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the patch to affected installations. No additional mitigation steps are indicated by the vendor.