ZDI-26-606: Microsoft Windows Compatibility Appraiser Link Following Local Privilege Escalation Vulnerability
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
ZDI-published vulnerability enables privilege escalation from LOCAL SERVICE to higher privileges on Windows systems; requires prior code execution in the LOCAL SERVICE context.
Description
The Compatibility Appraiser module in Microsoft Windows contains a vulnerability that allows a local attacker with execution rights in the LOCAL SERVICE context to escalate privileges. The vulnerability is triggered by improper handling of symbolic links and carries a CVSS score of 7.0. Exploitation requires the ability to execute code in the LOCAL SERVICE context first, which limits practical exploitability. Windows Server 2022 and Windows Server 2019 are affected by this vulnerability.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 15.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 16.00
- vendor mismatch penalty
- 0.00
Path: operational