Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Unvalidated elevated process launch (CWE-280) in the Windows Error Reporting service wersvc.dll, local EoP. CWerService::SvcElevatedLaunch is a legacy handler that starts a process with elevated privileges on behalf of a WER client, taking the image path, command line and handles straight from the client's _WERSVC_MSG request (param_1). After obtaining the requester handle via OpenSenderProcessThread, it copies user-controlled handle entries from the message buffer (array at +0x40, count at +0xc0) into a local array and passes the message-supplied image (+0x30), command line (+0x38) and handles to ElevatedProcessStart - with no validation of the binary or arguments, so a local attacker crafts the message to launch an arbitrary process elevated -> arbitrary code execution. IN-HOUSE ghidriff of wersvc.dll 10.0.26100.7309 -> .7623 (Jan 13 2026, KB5074109) confirms the fix: rather than add validation, the high-risk legacy elevated-launch is disabled, gated behind CFR flag Feature_2473284922 - when enabled, SvcElevatedLaunch sets param_2+0x28=1 and param_2+0x2c=0xC0000001 (STATUS_UNSUCCESSFUL) and returns without calling OpenSenderProcessThread/ElevatedProcessStart; the original launch survives only on the feature-disabled else branch, removing the attack surface. Note: our x64 24H2 diff shows Feature_2473284922, differing from the circulated screenshots' Feature_2741720378 (build/arch difference); the disable-the-feature mechanism is identical. We ship what our diff shows.

WER service starts an elevated process from an unvalidated client request message

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Ruslan Sayfiev with GMO Cybersecurity by Ierae
Denis Faiustov with GMO Cybersecurity by Ierae