Description

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:34.567Z",
  "pubdate": "2026-08-11T17:18:34.567Z",
  "executiveSummary": "An improper link resolution before file access vulnerability, commonly referred to as link following, exists in Windows DHCP Server. This security flaw enables an authorized local attacker to elevate their privileges on vulnerable systems.\nThe vulnerability resides within the file handling mechanisms of the Windows DHCP Server component. When the application accesses files without properly validating or resolving symbolic links, hard links, or junction points prior to the operation, it becomes susceptible to race conditions and object manipulation attacks.\nAn attacker with low-privileged local access can exploit this flaw by manipulating file system links to target sensitive system files. Successful exploitation allows the attacker to execute arbitrary operations with elevated system privileges, potentially leading to complete compromise of the affected host.\nPrerequisites for this attack include local execution capability and prior authentication on the target system. The risk implication is significant as it provides a reliable local vector for privilege escalation, bypassing standard access control mechanisms through file system abuse.",
  "technicalDetails": "The root cause of this vulnerability is an insecure file access pattern characterized by improper link resolution before file access, categorized under the concept of link following. In Windows DHCP Server, when the service performs read, write, or creation operations on designated files or directories, it fails to adequately verify whether the target path contains symbolic links, directory junctions, or hard links pointing to unintended system locations.\nThe exploitation method relies on time-of-check to time-of-use (TOCTOU) race conditions or direct object substitution. An authenticated, low-privileged local attacker establishes a carefully crafted file system structure, such as a junction point or symbolic link, in a directory location monitored or accessed by the Windows DHCP Server.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a file operation performed by the Windows DHCP Server service that interacts with the local file system using predictable paths or filenames. Second, the attacker prepares a malicious link pointing from the expected file location to a sensitive system file that the low-privileged user would normally not be able to modify directly, such as a system binary or configuration file subject to service-level permissions.\nThird, the attacker triggers the file access operation within the Windows DHCP Server component. Because the application processes the path without verifying if it resolves to a secure destination, the service follows the link and performs the file operation with its own elevated privileges, such as SYSTEM or high-integrity service accounts.\nThis behavior can lead to arbitrary file overwrite, unauthorized file creation, or unintended file disclosures depending on the exact nature of the file transaction. In the context of privilege escalation, this primitive is chained with other local techniques to achieve arbitrary code execution in the security context of the vulnerable service.\nAuthentication requirements dictate that the attacker must already possess valid local credentials and the ability to interact with the system locally. Privilege requirements are low, as standard domain or local user permissions are generally sufficient to create local directory junctions or symbolic links within permitted user directories or shared temporary locations, provided the service interacts with them insecurely."
}