CVE-2019-0986: microsoft windows_10 Link Following

Vulnerability summary

CVE-2019-0986 is a high (CVSS 7.1) Link Following vulnerability in microsoft windows_10. EPSS estimates a 2.07% chance of exploitation in the next 30 days, higher than 81.1% of scored vulnerabilities.

Timeline

1. 12-06-2019
   PublishedVulnerability first disclosed.
2. 20-05-2025
   Last modifiedVulnerability information updated.

Description

An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and delete files or folders of their choosing. The security update addresses the vulnerability by correcting how the Windows User Profile Service handles symlinks.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.