The enlightened lockdown policy check for COM Class instantiation can be bypassed in Scriptlet hosts leading to arbitrary code execution on a system with UMCI enabled (e.g. Device Guard).
0a5bddd8f4ee903a132da519d294e7d062747a20ed0b075e6bb7f8fecc61a6ff