CVE-2020-16853: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-16853) was discovered in the OneDrive for Windows Desktop application, related to improper handling of symbolic links. The vulnerability was disclosed in September 2020 and affects OneDrive for Windows Desktop systems (CVE Details).

The vulnerability stems from the OneDrive for Windows Desktop application's improper handling of symbolic links. When the OneDrive updater runs with elevated privileges, it incorrectly performs file write operations, potentially allowing for privilege escalation (NVD).

If successfully exploited, this vulnerability could allow an attacker to overwrite targeted files with an elevated status. The attack requires the attacker to first log into the system and then execute a specially crafted application (CVE Details).

To exploit this vulnerability, an attacker needs to have local access to the system and the ability to run a specially crafted application. The attack specifically targets the file operations performed by the OneDrive updater when running with elevated privileges (NVD).

Microsoft addressed this vulnerability by correcting how the OneDrive updater performs file writes while running with elevation. The fix was implemented in version 20.170.0824.0001 and all subsequent versions (Microsoft Community).