Executive brief
Windows NTFS contains a flaw in how it resolves symbolic links before accessing files, allowing an authorized local user to escalate their privileges on a system. An attacker with standard user access could exploit this to gain administrator-level permissions, potentially compromising the entire machine and all data it holds.
Technical details
This vulnerability is a time-of-check-time-of-use (TOCTOU) style symlink-following flaw in the Windows NTFS file system implementation. The vulnerability occurs when NTFS fails to properly validate and resolve symbolic links before performing privileged file access operations, allowing an authenticated local attacker to redirect file operations to unintended locations. An attacker with local user privileges can create or manipulate symbolic links to cause privileged operations to access or modify sensitive files outside the intended directory. The attack requires local access and an existing user account; no network vector is available. Patches should be available through Microsoft's regular security update channels.
Affected products
- Microsoft Windows multiple versions
Timeline
- 2026-09-08: disclosed