CVE-2026-15788: Improper Link Resolution Before File Access

BuildKit's cache mount source= selector on Windows Container on Windows WCOW workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon...

Anti-Virus Privileged File Write Vulnerability

Anti-Virus solutions are split into several different components an unprivileged user mode part, a privileged user mode part and a kernel component. Logically the different systems talk to each other. By abusing NTFS directory junctions it is possible from the unprivileged user mode part "the UI"...

Anti-Virus Privileged File Write

Dear list, This mail is not about a single vulnerability, but a more or less general technique I discovered to abuse the restore from quarantine feature in anti-virus solutions to gain local admin rights. As I also presented this attack at the IT SECX conference, I had to invent a name for it too...