This vulnerability arises from improper handling of symbolic links (directory junctions) before file access in the quarantine restoration feature of WatchDog Anti-Virus versions >=1.8.640 and <1.8.804 on Windows. A local attacker with low privileges can exploit this by creating a directory junction at the path of a quarantined file and then convincing an administrator to restore that file. The restoration process follows the link, causing the file to be written to an unintended location. This can lead to modification of protected system files or execution of code with SYSTEM privileges through DLL hijacking techniques.

The vulnerability allows local low-privileged attackers to influence the location where quarantined files are restored by exploiting improper link resolution. This can result in unauthorized modification of protected files or enable SYSTEM-level code execution via DLL hijacking, potentially compromising system integrity and security.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, administrators should exercise caution when restoring quarantined files, especially verifying the file paths and ensuring no suspicious directory junctions exist at those locations.