PT-2026-41934 · Dell · Portrait Dell Color Management

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-34883

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Portrait Dell Color Management versions prior to 3.7.0

Description A symbolic link issue exists in the Portrait Dell Color Management application on Windows. A local low-privileged user can escalate privileges to Administrator because the installer does not properly validate symbolic links or reparse points at the destination path when writing the file "CCFLFamily 07Feb11.edr" to "C:ProgramDataPortrait DisplaysCWdatai1D3" while running with elevated privileges. This allows an attacker to create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.

Recommendations Update to version 3.7.0 or later.

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-34883

Affected Products

Portrait Dell Color Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34883 · Security Note
• https://twitter.com/VulmonFeeds/status/2056776183526674501 · Twitter Post
• https://portrait.com/dell · Note
• https://twitter.com/CVEnew/status/2056994223266881728 · Twitter Post
• https://portrait.com/dell-security-cve-updates · Note