An improper link resolution before file access in Windows DHCP Server allows an authorized local attacker to obtain higher privileges. The weakness, identified as CWE-59, permits the attacker to follow a symbolic or hard link that points to a privileged path, enabling the execution of code or modification of files with elevated rights. Consequently, an attacker who already has access to the system can gain full control over the device, install malicious software, or modify DHCP configuration to disrupt network services.

Affected systems are Microsoft Windows operating systems that include the DHCP Server role. Specifically, Windows 10 version 1607 and 1809, Windows Server 2012 and 2012 R2 (including Server Core installations), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core installations). Any instance of these OS versions with the DHCP Server enabled is susceptible.

The vulnerability has a CVSS score of 7.8, signifying high severity and a potential for significant impact in a local environment. EPSS is not available, so the likelihood of exploitation in the wild is unknown, and the vulnerability is not listed in the CISA KEV catalogue. The typical attack vector is local; an attacker who can log onto the DHCP Server machine with sufficient privileges can manipulate link resolution to elevate their rights. Because the flaw requires only a local authorized account, the risk to organizations that permit local access to DHCP services remains high.