CVE-2026-96911: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-59 (Improper Link Resolution Before File Access), affects multiple builds of Microsoft Windows 10, including Version 1607 and later updates. It arises from the Windows Search Component improperly resolving symbolic links before accessing files. This flaw enables an authorized local attacker to escalate privileges on the affected system. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

An authorized local attacker can exploit this vulnerability to elevate their privileges, potentially gaining higher-level access than intended. This can lead to full system compromise, including unauthorized access to sensitive data and system control. The vulnerability affects confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96911 to remediate this vulnerability.