Description

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:35.010Z",
  "pubdate": "2026-08-11T17:18:35.010Z",
  "executiveSummary": "An improper link resolution before file access vulnerability, commonly known as link following, exists in Windows DHCP Server. This security flaw enables a locally authenticated attacker to manipulate file system operations and achieve local privilege escalation on targeted systems. The vulnerability resides within the file handling mechanisms of the DHCP Server component, where insufficient validation of symbolic links or hard links prior to file access allows unauthorized modification or interaction with restricted system files. To successfully exploit this vulnerability, an attacker must already possess local access to the system and authorization to interact with the affected service. The exploitation of this flaw can lead to unauthorized elevation of privileges, allowing the attacker to execute arbitrary code or manipulate system resources with elevated security contexts. The risk implication is significant as it provides a pathway for local threat actors to escalate their access levels, potentially compromising the integrity and confidentiality of the underlying operating system. No specific network exposure is required for this attack vector, as exploitation is strictly local.",
  "technicalDetails": "The vulnerability is classified as an improper link resolution before file access defect, which occurs when a privileged process accesses files based on path names provided by an unprivileged or lower-privileged user without adequately verifying the nature of the path. In the context of Windows DHCP Server, the vulnerable component improperly resolves symbolic links, junctions, or other reparse points during file creation, read, or write operations.\nThe root cause stems from a race condition or a time-of-check to time-of-use (TOCTOU) vulnerability combined with inadequate access control checks on file targets. Specifically, when the DHCP Server performs administrative file operations, an attacker can substitute a targeted file path with a maliciously crafted symbolic link pointing to a critical system file or resource that the service has permission to modify.\nThe attack flow proceeds as follows: First, the attacker identifies a file operation performed by the Windows DHCP Server where the file path or location can be influenced indirectly or where temporary files are handled predictably. Second, the attacker establishes a symbolic link or junction point in a directory accessible to their privilege level, directing the path to a sensitive system file. Third, the attacker triggers the file access operation within the DHCP Server service. Because the service fails to properly validate the link resolution before accessing the file, it follows the attacker-controlled link rather than interacting with the intended safe location. Finally, the service performs the read or write operation on the sensitive file under the security context of the DHCP service, which typically operates with elevated privileges such as SYSTEM or Network Service.\nPrerequisites for exploitation include local access to the target host and authorization to interact with the Windows DHCP Server environment. The attack vector is strictly local, requiring no network exposure or remote interaction. The resulting post-exploitation impact allows the local attacker to leverage the elevated privileges of the DHCP Server process to overwrite critical system files, potentially leading to arbitrary code execution, complete system compromise, and persistence at the highest privilege levels."
}