Description

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:30.600Z",
  "pubdate": "2026-08-11T17:18:30.600Z",
  "executiveSummary": "An improper link resolution before file access vulnerability, commonly referred to as link following, exists in the Windows DHCP Server component. This security flaw enables a locally authenticated attacker to manipulate file system operations and elevate their privileges on the target host.\nThe vulnerability affects Windows DHCP Server across supported deployments. Successful exploitation grants the adversary elevated system privileges, allowing them to bypass standard access controls and potentially compromise the integrity and confidentiality of the host operating system.\nExploitation requires local access to the system and that the attacker is already authorized to interact with the local environment. The attack vector relies on manipulating file system links, such as symbolic links or junction points, to intercept or redirect privileged file access requests initiated by the DHCP Server service.\nThe primary risk implication is local privilege escalation, which can lead to complete system compromise if the attacker chains this vulnerability with other local exploits or misconfigurations. Mitigation requires applying official vendor patches as soon as they become available and adhering to secure file system and privilege management practices.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure file handling within the Windows DHCP Server component. Specifically, the service fails to properly resolve or validate links, such as symbolic links or hard links, before performing file access operations. This design flaw creates a race condition or a direct logic gap where the application operates on user-controlled file system locations while running with elevated system privileges.\nThe vulnerable component is the Windows DHCP Server service, which executes with high-integrity privileges such as SYSTEM or LOCAL SERVICE. Because the service performs administrative file Input/Output operations without adequately checking whether the target path resolves to an unintended location, it becomes susceptible to link-following attacks.\nThe attack flow typically proceeds in several discrete steps. First, an authorized local attacker identifies a file operation performed by the Windows DHCP Server where the service creates, opens, or modifies files in a predictable location. Second, the attacker establishes a maliciously crafted symbolic link or junction point in that location, pointing to a sensitive system file that the user would normally not be permitted to modify directly.\nThird, the attacker triggers the DHCP Server functionality that initiates the file access sequence. As the service processes the request, it follows the crafted link rather than validating the true destination of the file path. Consequently, the privileged service performs the intended file operation, such as an arbitrary write or overwrite, on the sensitive target file.\nThe post-exploitation impact of this behavior allows the attacker to corrupt system files, plant malicious binaries, or manipulate critical configuration data, culminating in a successful local privilege escalation to the security context of the Windows DHCP Server service. Network exposure is strictly local, as the attack requires prior local authentication and execution capabilities on the host system."
}