Windows Error Reporting Flaw Allows Attackers to Elevate Privileges

A high-severity local privilege escalation (CVE-2026-20817) was disclosed in the Windows Error Reporting Service (wersvc.dll), where improper permission checks let a standard user craft requests that result in elevated process creation (WER helper process) with up to ~520 bytes of attacker-controlled command-line arguments; Microsoft published mitigations/patch guidance and organizations are advised to monitor WerFault/WerMgr process creation and abnormal token characteristics.