Windows 10^H^H Symbolic Link Mitigations

Summary: Microsoft added three symbolic link mitigations to Windows 10 and back ported them via MS15-090 as far back as Windows Vista, changing who can create registry key symbolic links, object manager symbolic links, and NTFS mount points. The checks rest on a new kernel function, RtlIsSandboxToken, which treats a caller as sandboxed if it runs below medium integrity or inside an AppContainer, and each link type is handled differently to preserve application compatibility.
Key Takeaway: Project Zero's James Forshaw used these link types as primitives against Chrome, IE, and Adobe Reader sandboxes, citing CVE-2015-0055, CVE-2014-6322, CVE-2014-0568, and CVE-2015-2428 through CVE-2015-2430 - and the mitigations target only sandbox-to-sandbox elevation, not system-level escalation.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-0055
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026