Description

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:28.860Z",
  "pubdate": "2026-08-11T17:18:28.860Z",
  "executiveSummary": "An improper link resolution before file access vulnerability, commonly known as link following, exists in the Windows DHCP Server component. This security flaw allows an authorized local attacker to elevate their system privileges. The vulnerability impacts the Windows DHCP Server product line, introducing significant risk to enterprise environments where local access controls might otherwise limit unauthorized administrative actions. To exploit this vulnerability, an attacker must already possess local access to the target system and requisite authorization to interact with the affected service. Successful exploitation enables the adversary to manipulate file access operations, bypassing standard security boundaries and achieving local privilege escalation. This can lead to unauthorized modification of critical system resources and complete compromise of the host operating system.",
  "technicalDetails": "The vulnerability resides in the Windows DHCP Server component and stems from improper link resolution before file access, which is categorized as a link following flaw. In a typical link following scenario, the application fails to adequately validate or handle symbolic links, junctions, or hard links prior to performing file system operations such as reading, writing, or deleting files. This architectural oversight allows a low-privileged local process to redirect file operations intended for a secure, isolated location to sensitive system files that the unprivileged user would normally be restricted from modifying. The root cause is the insecure handling of file system traversal and resolution in privileged contexts managed by the DHCP service. An attacker with local execution capabilities and authorization to interact with the DHCP server can create crafted symbolic links or directory junctions within file paths processed by the service. When the Windows DHCP Server executes file access operations, it resolves these malicious links without proper checks, causing the service to interact with arbitrary files under the attacker's strategic direction. By substituting target files with critical system binaries, configuration files, or data structures, the attacker can induce the service to overwrite or manipulate these files with elevated system privileges. The attack flow proceeds as follows: first, the local attacker establishes the necessary symbolic link structures in a monitored directory path. Second, the attacker triggers a DHCP server function that initiates file access routines. Third, the service resolves the link, inadvertently operating on the protected target file. Finally, through race conditions or direct file manipulation made possible by the privileged context of the service, the attacker achieves unauthorized modifications leading to local privilege escalation. The vulnerability requires local access and specific authorization to interact with the Windows DHCP Server, and exposure is restricted to the local host as network exposure is not a primary vector for this specific file system interaction."
}