Loading vulnerability…
CVE-2026-20817 is a local elevation-of-privilege vulnerability in the Windows Error Reporting (WER) service. The flaw is attributed to improper handling of insufficient permissions or privileges in the WER ALPC request path, specifically in the SvcElevatedLaunch functionality implemented in WerSvc.dll. A low-privileged local user can send a crafted ALPC message to the WER service and supply a shared-memory-backed buffer containing attacker-controlled command-line arguments. The vulnerable logic duplicates the supplied mapping handle, reads the user-controlled data, and invokes the internal elevated process creation path that launches WerFault.exe under a highly privileged token. Microsoft’s patch analysis indicates the vendor remediated the issue by disabling the vulnerable SvcElevatedLaunch feature entirely rather than hardening the original authorization logic. Successful exploitation can result in execution in SYSTEM context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Small standalone Windows local privilege escalation PoC repository with 4 files: a .gitignore, a VS Code settings file, a large helper header (ntalpcapi.h) containing ALPC/LPC structure and API definitions, and the main exploit source (poc.cpp). The exploit is not part of a known framework. The core logic is in poc.cpp. It dynamically resolves NtAlpcConnectPort and NtAlpcSendWaitReceivePort from ntdll.dll, prepares an unnamed shared memory mapping sized for a 260-WCHAR command line, writes attacker-controlled arguments into that mapping, then connects to the local WerSvc ALPC interface. It constructs a packed WERSVC_MSG structure with fields such as MessageFlags=0x50000000, Unknown=1, and FileMapping set to the shared section handle. The message is then sent with NtAlpcSendWaitReceivePort to trigger the WerSvc 'SvcElevatedLaunch' path described in the banner/comments. The stated purpose is exploitation of CVE-2026-20817, a WerSvc elevation-of-privilege issue. The intended capability is low-privileged to SYSTEM escalation by causing WerSvc to launch WerFault.exe with a controlled command line. This is a true exploit PoC rather than a detector: it performs the full ALPC interaction and includes the payload mechanism (controlled command-line injection via shared memory), but it is still relatively narrow and hardcoded, so OPERATIONAL is the best maturity fit rather than WEAPONIZED. No external network infrastructure, URLs, or remote C2 endpoints are present. The attack surface is purely local Windows IPC through ALPC. The most fingerprintable artifacts are the use of ntdll native ALPC APIs, the crafted WERSVC_MSG structure, the shared memory mapping used to pass command-line data, and the targeting of WerSvc/WerFault.exe.
Repository is a small Visual Studio C++ PoC project for CVE-2026-20817 (Windows Error Reporting ALPC EoP). Structure: a VS solution (CVE-2026-20817.sln) and project files (CVE-2026-20817.vcxproj/.filters) building a single console application source file (CVE-2026-20817_PoC.cpp), plus README and AGPL license. Core exploit logic (in CVE-2026-20817_PoC.cpp): defines the WER ALPC port name "\\WindowsErrorReportingService" and crafts a packed WER_ALPC_MESSAGE containing a method field set to 0x0D (SvcElevatedLaunch), the client PID, a shared memory handle, and command-line length. The PoC creates a shared memory region sized ~0x208 bytes to hold an attacker-controlled command line, then (per comments/structure) connects to the WER ALPC port and sends the crafted message to coerce the service into launching WerFault.exe with the supplied command line under SYSTEM. After a delay, it enumerates processes (Toolhelp32 snapshot) to find WerFault.exe and, if accessible, opens its token and prints enabled/disabled privileges as a demonstration. No network IOCs are present; the only fingerprintable targets are the local ALPC port name and the spawned process name. The code is presented as a proof-of-concept rather than a robust weaponized exploit (e.g., limited error handling, demo-style token inspection, and no full post-exploitation workflow).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day User Account Control (UAC) bypass vulnerability referenced as being present in the analyzed malware chain.
A local privilege escalation vulnerability in the Windows Error Reporting (WER) service that can allow a low-privileged local user to gain SYSTEM access by abusing ALPC message handling and elevated process launch functionality.
A local privilege escalation vulnerability in the Windows Error Reporting service that allows a low-privilege user to send a crafted ALPC message causing the service to launch WerFault.exe with SYSTEM privileges using user-controlled command-line options.
A critical local privilege escalation vulnerability in Microsoft Windows Windows Error Reporting (WER) service where insufficient permission validation on an exposed ALPC interface (SvcElevatedLaunch / method 0x0D) allows a low-privileged authenticated user to spawn WerFault.exe with attacker-controlled command-line parameters, resulting in SYSTEM-level code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.