Description

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:34.730Z",
  "pubdate": "2026-08-11T17:18:34.730Z",
  "executiveSummary": "A local privilege escalation vulnerability exists in the Windows DHCP Server involving improper link resolution before file access, commonly known as link following. The flaw enables an authorized local attacker to manipulate file system interactions to elevate privileges on vulnerable systems.\nThe vulnerability specifically affects Windows DHCP Server implementations where insufficient validation of symbolic links or hard links occurs prior to performing sensitive file operations. An attacker who has successfully authenticated locally can exploit this logic flaw to induce the service into interacting with unintended files.\nSuccessful exploitation of this security issue grants the adversary unauthorized privilege elevation, potentially leading to system-level compromise depending on the execution context of the vulnerable Windows DHCP Server service. The attack requires local access and prior authentication to the target system, meaning external network exploitation is not directly feasible without a prior execution vector.\nOrganizations operating affected Windows DHCP Server instances face elevated risks if unauthorized local users obtain execution capabilities, as successful exploitation bridges standard user permissions to higher privilege tiers, bypassing intended access control mechanisms.",
  "technicalDetails": "The root cause of the vulnerability stems from improper link resolution before file access, classified under the broader category of Time-of-Check to Time-of-Use (TOCTOU) race conditions or insecure file system manipulation via symbolic link following. When the Windows DHCP Server component handles file read, write, or creation operations, it fails to adequately verify whether the target path resolves to a symbolic link, junction point, or hard link pointing to a protected system resource.\nThe vulnerable component resides within the file handling routines of the Windows DHCP Server service. Attackers leverage local access to plant specially crafted symbolic links or directory junctions within file system locations accessible or processed by the DHCP service. During standard service operations—such as writing configuration data, logs, or database files—the service follows the attacker-controlled link without verifying the final destination's security attributes or ownership.\nThe step-by-step attack flow typically proceeds as follows: First, the authorized local attacker identifies a file system location where the Windows DHCP Server performs privileged file I/O operations. Second, the attacker establishes a symbolic link or object redirection pointing from the expected service file path to a sensitive system file that the service normally cannot overwrite or modify directly, but which the service account's privileges might permit if treated as a standard file write. Third, the attacker triggers the DHCP service functionality that initiates the file access operation. Fourth, the service blindly follows the link, executing the read, write, or modification operation against the unintended target resource.\nExploitation requirements dictate that the attacker must possess local interactive or programmatic access to the host running the Windows DHCP Server, alongside valid authentication credentials or the ability to execute code locally. The network exposure of this vulnerability is strictly local, as remote vectors cannot directly induce the specific file system link resolution flaw without a separate remote code execution or local access mechanism. Post-exploitation impact includes local privilege escalation, allowing the attacker to manipulate critical system files, potentially overwrite binaries, or achieve arbitrary code execution within the context of the service account."
}