Description

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:37.113Z",
  "pubdate": "2026-08-11T17:18:37.113Z",
  "executiveSummary": "An improper link resolution before file access vulnerability, commonly referred to as link following, exists in the Windows User Profile Service. This security flaw enables a locally authenticated attacker to execute unauthorized operations and achieve local privilege escalation on targeted systems. The vulnerability resides within the file handling logic of the service, where insufficient validation of symbolic links, hard links, or junction points prior to file access operations allows manipulation of expected file system interactions.\nSuccessful exploitation requires the attacker to have prior local access to the system and valid user credentials. By abusing the improper link resolution mechanism, an adversary can coerce the privileged Windows User Profile Service into reading, writing, or interacting with arbitrary files on the system with elevated system privileges. This capability can be leveraged to overwrite critical system binaries, tamper with sensitive configuration files, or compromise system integrity, ultimately resulting in complete control over the affected operating system instance.\nThe risk implications are critical for multi-user environments or systems where untrusted local users have execution rights. Because the vulnerability affects a core operating system component responsible for managing user profiles, standard unprivileged users can potentially bridge the security boundary separating standard user execution from high-privileged system operations. Remediation requires applying official vendor patches as soon as they become available and adhering to secure file system hardening principles.",
  "technicalDetails": "The root cause of this vulnerability is improper link resolution before file access within the Windows User Profile Service. When the service performs file or directory operations during profile management routines, it fails to adequately verify whether the target path resolves to a symbolic link, junction point, or hard link controlled by a lower-privileged user. This race condition or logic flaw allows a malicious actor to redirect file I/O operations from a benign, user-writable location to a protected system resource.\nThe exploitation method relies on directory junction creation and object naming manipulation. An attacker with local access establishes a structure containing symbolic links or mount points within a user-controlled directory prior to the execution of targeted profile service actions. When the Windows User Profile Service processes user profile data, it inadvertently follows the malicious link due to the lack of secure checks such as atomic file resolution or explicit validation against redirection.\nThe attack flow proceeds as follows: First, the attacker identifies a file access operation performed by the Windows User Profile Service that lacks secure link verification. Second, the attacker prepares a redirection vector, such as a symbolic link pointing from the expected service target path to a privileged system file. Third, the attacker triggers the profile service action, either by initiating specific profile-related activities or waiting for routine service operations. Fourth, the service attempts to access the resource, follows the crafted link, and performs read or write operations against the unintended target file under the context of the service account.\nThe vulnerable component is the Windows User Profile Service, which executes with elevated system privileges. The vulnerability can be exploited locally without network exposure, as it requires local interactive or programmatic access to the host. The privilege requirements for the attacker are low, as standard authenticated users can typically create local symbolic links within user-accessible directories. Post-exploitation impact includes arbitrary file modification or creation, which can lead to code execution under elevated privileges, system instability, or complete compromise of the local machine."
}