PatchSiren cyber security CVE debrief
CVE-2026-34883 Portrait Displays CVE debrief
CVE-2026-34883 is a Windows local privilege escalation issue affecting Portrait Dell Color Management before 3.7.0 for Dell monitors. The installer runs with elevated privileges and writes a file into a ProgramData path without properly validating symbolic links or reparse points. A low-privileged local attacker can abuse that behavior to redirect the write to another location, enabling arbitrary file creation or overwrite with elevated privileges. The reported impact is privilege escalation to Administrator, with NVD assigning CVSS 3.1 5.3 (Medium).
- Vendor
- Portrait Displays
- Product
- Portrait Dell Color Management
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-19
- Original CVE updated
- 2026-05-19
- Advisory published
- 2026-05-19
- Advisory updated
- 2026-05-19
Who should care
Organizations that use Portrait Dell Color Management on Windows endpoints, especially systems where standard users can access the local machine during software installation or update windows. Endpoint management, desktop engineering, and IT teams should prioritize systems with Dell monitors and Portrait software installed.
Technical summary
According to the CVE description and NVD metadata, the vulnerability is a CWE-59 symbolic link / reparse point issue. During installation, the application writes CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running elevated. If the destination path is a malicious link or reparse point and the installer fails to validate it correctly, the write can be redirected to an arbitrary system path. That creates a path for local privilege escalation through arbitrary file creation or overwrite. The affected version is before 3.7.0.
Defensive priority
High for systems running the affected software, because the flaw is local but can cross privilege boundaries during an elevated install. The absence of KEV listing does not reduce the need to patch on exposed endpoints.
Recommended defensive actions
- Update Portrait Dell Color Management to version 3.7.0 or later if available from the vendor.
- Review endpoints that have Portrait Dell Color Management installed, especially Windows systems used by multiple users or with local admin separation.
- Restrict which users can initiate installs or updates of vendor software that runs with elevated privileges.
- Monitor installation paths under C:\ProgramData\Portrait Displays\ for unexpected symlinks, reparse points, or unauthorized file changes.
- If patching is delayed, reduce exposure by limiting local interactive access and using least privilege for standard users.
Evidence notes
Evidence is limited to the supplied NVD CVE record and its cited references. NVD lists the weakness as CWE-59 and the vector as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The CVE description states the issue affects Portrait Dell Color Management before 3.7.0 and references Portrait vendor pages at portrait.com/dell and portrait.com/dell-security-cve-updates/. Those pages were cited in the source corpus but were not otherwise expanded here, so vendor attribution should be treated as low-confidence until confirmed from the official vendor advisory.
Official resources
Publicly disclosed on 2026-05-19 per the supplied CVE publication timestamp. NVD shows the record was modified the same day. No KEV addition is listed in the supplied timeline.