Lenovo LDE (LdeApi.Server.exe) Unimpersonated Junction-Based Arbitrary File Write to SYSTEM (CVE-2026-0827)

Metadata

Affected Target

Summary

The Lenovo LDE service process LdeApi.Server.exe runs as SYSTEM and periodically writes a file named MP27AM7W_estimation.json into C:\ProgramData\Lenovo\LDE\SYSTEM without impersonating the calling user and without verifying the target path is a real directory it controls. Because C:\ProgramData allows standard users to create new subdirectories, a low-privileged attacker can pre-create the Lenovo\LDE\SYSTEM path themselves and convert the final SYSTEM folder into an NTFS mount point/junction that redirects to \RPC Control, then place an NT object-manager symbolic link named MP27AM7W_estimation.json pointing at an arbitrary file path. When the SYSTEM service later writes its status file, it follows the reparse point and symlink, resulting in an arbitrary file write (or overwrite) performed with SYSTEM privileges at a location the attacker chose — a classic privilege-escalation primitive credited to Google Project Zero researcher James Forshaw’s junction/symlink write techniques.

Vulnerability Details

Root Cause

LdeApi.Server.exe writes MP27AM7W_estimation.json under C:\ProgramData\Lenovo\LDE\SYSTEM without impersonating the requesting user’s token and without validating that the path is not a reparse point/junction under attacker control. Since ProgramData is user-writable for subdirectory creation, and the deeper SYSTEM folder does not exist by default, an attacker can seed the directory structure and redirect the final component via an NTFS junction to \RPC Control, then use an NT symbolic link to retarget the actual write to any file on the system. CWE class: unimpersonated file operation combined with insecure use of a user-controllable path (junction/symlink following).

Attack Vector

1. Create the missing parent path C:\ProgramData\Lenovo\LDE as a standard user.
2. Create the SYSTEM subdirectory and convert it into an NTFS mount point (junction) targeting the NT object directory \RPC Control using NtFile.SetMountPoint.
3. Create an NT symbolic link named MP27AM7W_estimation.json inside \RPC Control that points at the desired target file (e.g. a DLL, config, or system file the attacker wants to overwrite).
4. Trigger (or wait for) the Lenovo LDE service to perform its routine status-file write.
5. The SYSTEM-privileged service follows the junction and symlink chain and writes attacker-controlled content to the attacker-chosen target path — this write occurs with SYSTEM privileges regardless of the local attacker’s actual permissions on that target.

Impact

Local privilege escalation: a standard user can cause SYSTEM-privileged arbitrary file write/overwrite, which can be chained into full SYSTEM code execution (e.g. by overwriting a binary or configuration file loaded by a privileged process).

Environment / Lab Setup

Target:   Windows host with Lenovo LDE (LdeApi.Server.exe) installed and running as SYSTEM
Attacker: .NET (C#) build environment with NtApiDotNet NuGet package; standard/low-privileged Windows user account

Proof of Concept

PoC Script

See CVE-2026-0827/Program.cs in this folder.

1

CVE-2026-0827.exe C:\path\to\target\file

The PoC creates the Lenovo\LDE parent directory under ProgramData, converts the SYSTEM subfolder into an NTFS junction pointing at \RPC Control, plants an NT symbolic link named MP27AM7W_estimation.json targeting the attacker-supplied file path, then waits for the operator to trigger the Lenovo service before checking whether the target file was created/overwritten, and finally cleans up the junction.

Detection & Indicators of Compromise

fsutil reparsepoint query "C:\ProgramData\Lenovo\LDE\SYSTEM"

Signs of compromise:

• A SYSTEM folder under C:\ProgramData\Lenovo\LDE that is a reparse point/junction rather than a normal directory.
• SYSTEM-owned writes to files outside the expected Lenovo LDE data directory, timestamped near LdeApi.Server.exe activity.
• Presence of unexpected NT object-manager symbolic links under \RPC Control created by a non-SYSTEM process.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/ZeroMemoryEx/CVE-2026-0827 on 2026-07-05.