Introduction

The recent April 2025 cumulative update for Windows 11 has introduced a curious and controversial change: the automatic creation of an empty INLINECODE0 folder at the root of the system drive, typically C:\inetpub. Traditionally tied to Microsoft's Internet Information Services (IIS) web server, this folder's unexpected appearance on all Windows 11 systems—even those without IIS enabled—has sparked concern and confusion within the Windows community.

While initially seeming like an innocent system artifact or potential bloat, the INLINECODE1 folder is in fact a deliberate security enhancement introduced to mitigate a serious vulnerability (CVE-2025-21204) related to symbolic link (symlink) manipulation during Windows update processes. However, this fix has itself introduced a new security risk and practical challenges for system stability.

Background and Technical Context

The Role of INLINECODE2

Historically, INLINECODE3 is the default directory for IIS to store web content, logs, scripts, and administrative tools. It normally exists only on systems with IIS installed.

The Vulnerability CVE-2025-21204

This vulnerability involves improper handling of symbolic links within the Windows Update servicing stack, which runs under the SYSTEM account. Symlinks are filesystem objects that redirect operations to other files or folders. An attacker with local access could exploit this by creating malicious symbolic links or directory junctions that redirect Windows Update operations to unauthorized locations, allowing privilege escalation or tampering with critical system files.

Microsoft's Security Mitigation

As a mitigation, Microsoft decided to pre-create the INLINECODE4 folder across all systems with restricted system-level permissions. This locked-down folder serves as a "hardened container" or "safe zone" where Windows Update can stage files securely, preventing symlink manipulations targeting missing or inadequately protected directories. It acts as a trusted, tamper-resistant placeholder to reduce attack surfaces in the update process.

Microsoft explicitly warns users not to delete this INLINECODE5 folder as doing so disables the patch's security benefits and re-exposes systems to attacks.

The New Vulnerability: Directory Junction Hijacking

Ironically, security researcher Kevin Beaumont discovered that local users, even those without administrative permissions, can exploit the very INLINECODE6 folder meant to enhance security. Using a command such as:

CODEBLOCK0

an attacker can replace the legitimate INLINECODE7 folder with a directory junction pointing to an arbitrary file or location. Since the Windows servicing stack blindly trusts the INLINECODE8 path and does not verify for reparse points or ownership, this causes Windows Update to stage files incorrectly, resulting in update failures or rollbacks. The consequence is effectively a local denial-of-service (DoS) attack on the update mechanism.

This exploit requires no elevated privileges, meaning any user with local access can disrupt system updates, increasing security risks and instability.

Implications and Impact

  • Security Risks: Systems may fail to install critical security patches, increasing exposure to malware and exploits.
  • System Stability: Windows Update failures can cause confusing errors and may necessitate extensive troubleshooting.
  • IT Support Challenges: Understanding and mitigating this issue requires manual intervention, including permission lockdowns and possibly folder restoration.

Until Microsoft issues an official fix addressing this junction vulnerability, users and administrators should:

  1. Never delete the INLINECODE9 folder.
  2. Restrict permissions on the INLINECODE10 folder to prevent unauthorized users from modifying it:
  • Right-click the folder, select Properties
  • Go to Security > Advanced
  • Disable inheritance and remove all inherited permissions
  • Add Full Control permissions only for SYSTEM and TrustedInstaller accounts
  1. Restore the folder if accidentally deleted by either temporarily enabling IIS (via "Turn Windows features on or off") or reinstalling the Windows update.
  2. Monitor Windows Update errors closely, as unexpected failures might indicate exploitation attempts.

If update errors occur after changing folder permissions, resetting Windows Update components may help.

Broader Security Lessons

This incident highlights the complexity and fine balance in modern OS security management:

  • Security patches may inadvertently create new attack surfaces.
  • Trusted system components must validate underlying filesystem objects to prevent misuse.
  • Users and administrators need to be informed about subtle system changes and their risks.

Microsoft’s cautious approach to vulnerability disclosure and patch rollout means interim manual mitigations remain crucial.

Conclusion

The INLINECODE11 folder's surprising emergence on Windows 11 after the April 2025 update reflects Microsoft's layered defense against symbolic link vulnerabilities threatening system integrity. Nevertheless, the folder's exploitability through directory junctions reveals a paradox: a security fix that itself requires further tightening. Users, IT professionals, and sysadmins should heed Microsoft's guidance, apply permission-based mitigations, and stay vigilant for future patches.