EIP-2026-117515

The writeup describes a TOCTOU (Time-of-Check Time-of-Use) vulnerability in the Windows Installer service's `MsiAdvertiseProduct` function, allowing arbitrary file reads as SYSTEM via junction manipulation. The PoC involves a race condition to exploit the impersonation check, enabling unauthorized access to files like `desktop.ini` or document metadata.