Windows Error Reporting Vulnerability Exposes Systems to Privilege Escalation, Allowing SYSTEM Access

Microsoft patched CVE-2026-20817, a critical local privilege escalation in the Windows Error Reporting (WerSvc.dll) service that permitted a low-privileged local attacker to gain SYSTEM via specially crafted ALPC messages and a shared file-mapping buffer; researchers published a functional PoC, Microsoft mitigated the issue by deadcoding the vulnerable function, and Windows Defender detects exploitation attempts.