# CVE-2026-49176 — Windows WalletService `walletservice.dll` Post-Creation By-Path Folder Restrict in `HideAndRestrictFolder` → Link Following / Improper Privilege Management

---

## Summary

| | |
|---|---|
| **Product** | Windows — `walletservice.dll` (Windows WalletService, runs as SYSTEM) |
| **CVE ID** | CVE-2026-49176 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-269: Improper Privilege Management + CWE-59: Link Following |
| **Delivery** | Local — a planted link/junction at the wallet folder path during provisioning |
| **KB / Fixed build** | KB5101650 — `walletservice.dll` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `walletservice.dll` 10.0.26100.8737 — SHA256 `51a15901b445f0f58d0930535b2136bb567e56709291ca758f5a8265d66f4d12` |
| **Post-patch binary** | `walletservice.dll` 10.0.26100.8875 — SHA256 `b9b1b38e9036f9b55634bcd8181e779ebfc599587da4b374bf33fbe124d04880` |
| **Feature flag** | `Feature_3305877819` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`walletservice.dll` implements the Windows **WalletService**, which runs as SYSTEM
and provisions a per-user wallet database (ESE) folder. During provisioning,
`Wallet::WalletDatabaseESE::Open` creates/opens the wallet folder and the service
then secured it with `Wallet::ServerUtils::HideAndRestrictFolder`, which operates on
the folder **by path**:

```c
// HideAndRestrictFolder (pre) — from our diff
DVar1 = GetFileAttributesW(param_1);
if ((DVar1 & FILE_ATTRIBUTE_HIDDEN) == 0)
    SetFileAttributesW(param_1, DVar1 | FILE_ATTRIBUTE_HIDDEN);   // hide, by path
IsFolderRestricted(param_1, &restricted);
if (!restricted) RestrictFolder(param_1);                         // build+apply ACL, by path
```

`RestrictFolder` builds an ACL (`InitializeAcl` / `AddAccessAllowedAceEx(..., 0x1fffff, ...)`)
and applies it to the folder named by `param_1`.

---

## Vulnerability Summary

Because the hide/restrict operations act on the wallet folder **by name, after it is
created**, the sequence is exposed to link following and a create-then-restrict
race. A local user can plant a symbolic link / junction at the wallet folder path so
that the SYSTEM service's `SetFileAttributesW` / `RestrictFolder` (and the
attribute/ACL changes they make) follow the link and are applied to an
attacker-chosen target rather than the intended folder — improper privilege
management via link following (CWE-269 + CWE-59). Because WalletService performs the
operation as SYSTEM, redirecting it is a local elevation-of-privilege primitive to
SYSTEM (per the MSRC FAQ).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): induce WalletService to provision
  its wallet folder.
- Plant a symbolic link / junction at the wallet folder path so the by-path
  hide/restrict follows it.
- Result: SYSTEM applies folder attributes/ACLs to the link target.

---

## Vulnerability Details

### Root Cause

The wallet folder was created first and then secured by path (hide + ACL), so a
link placed at that path redirected the SYSTEM service's privileged file operations,
and the non-atomic create-then-restrict left a window of improper privilege
management.

### The patch (confirmed — diff, .8737 → .8875)

Gated behind `Feature_3305877819`, `HideAndRestrictFolder` **no longer performs the
post-creation by-path hide/restrict** — when the flag is enabled the entire
`GetFileAttributesW`/`SetFileAttributesW` + `IsFolderRestricted`/`RestrictFolder`
block is skipped:

```c
// HideAndRestrictFolder (10.0.26100.8875) — PATCHED (from our diff)
if (Feature_3305877819__private_IsEnabled()) {
    lVar4 = 0;               // *** skip the by-path hide/restrict entirely ***
} else {
    // legacy: GetFileAttributesW/SetFileAttributesW(hidden); IsFolderRestricted; RestrictFolder(param_1)
}
```

The wallet folder's security is instead established through the reworked
`Wallet::WalletDatabaseESE::Open` (and `HandleDatabaseCorruption` / `FileUtils::DeleteFiles`)
path so the folder is restricted at creation rather than by name afterward,
removing the follow-the-link window.

> The fix is confirmed as the `Feature_3305877819`-gated removal of the racy by-path
> restrict; the exact secure-creation replacement spans the reworked `Open` /
> corruption-handling path.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3305877819`.** The hardened behaviour runs only when the
flag is enabled; the original by-path restrict still ships when disabled. Verify
`Feature_3305877819` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Symbolic links / junctions planted at the WalletService wallet
folder path; SYSTEM `SetFileAttributesW` / ACL operations from
`walletservice!Wallet::ServerUtils::HideAndRestrictFolder` / `RestrictFolder`
resolving outside the intended wallet directory on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_3305877819` is enabled.

---

## References

- MSRC advisory — CVE-2026-49176 (Windows WalletService Elevation of Privilege), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/walletservice_dll-cve-2026-49176-ghidriff.md`