PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation
A critical local privilege escalation (LPE) vulnerability affecting Microsoft Windows has been identified following the public release of a Proof-of-Concept (PoC) exploit.
A critical local privilege escalation (LPE) vulnerability affecting Microsoft Windows has been identified following the public release of a Proof-of-Concept (PoC) exploit.
Tracked as CVE-2026-20817 , this security flaw is located within the Windows Error Reporting (WER) service.
The vulnerability permits an authenticated user with low-level privileges to execute arbitrary malicious code with full SYSTEM privileges.
The detailed research and accompanying C++ PoC exploit were published on GitHub by security researcher @oxfemale.
The release highlights a significant security gap in Windows' error-reporting mechanisms for interprocess communication.
The core of this vulnerability involves the Advanced Local Procedure Call (ALPC) protocol .
The WER service exposes a specific ALPC port named \WindowsErrorReportingService to facilitate communication with other processes.
Tracked as CVE-2026-20817 , this security flaw is located within the Windows Error Reporting (WER) service.
According to the researcher's findings, the flaw specifically exists in the SvcElevatedLaunch method, identified as method 0x0D. The WER service fails to properly validate the calling user’s permissions.
As a result, an attacker can force the service to launch WerFault.exe using custom command-line parameters supplied from a shared memory block.
To successfully trigger the exploit, an attacker follows a straightforward sequence of actions:
Create Shared Memory: Create a shared memory block containing an arbitrary, malicious command line. Connect to WER ALPC Port: Establish a local connection to the Windows Error Reporting (WER) ALPC port. Send ALPC Message (Method 0x0D): Send an ALPC message using method 0x0D, including the client process ID, the shared memory handle, and the exact command-line length. Trigger Command Execution: The WER service duplicates the handle and launches WerFault.exe with the supplied command line.
Because the WER service runs at a high-privilege level, the newly spawned process inherits the SYSTEM token .
This token includes dangerous permissions, such as SeDebugPrivilege (which allows debugging any process) and SeImpersonatePrivilege (which allows impersonating any user).
While it does not grant SeTcbPrivilege to act as part of the operating system itself, the obtained privileges still provide full system access.
The vulnerability impacts a wide range of operating systems, including all versions of Windows 10 and Windows 11 before January 2026, as well as enterprise server environments running Windows Server 2019 and Windows Server 2022.
Microsoft officially addressed this vulnerability in the January 2026 Security Update .
According to the PoC published on GitHub , organizations and system administrators are strongly advised to apply the latest security patches immediately to secure their networks.
Security teams should also monitor their environments for unusual WerFault.exe child processes and irregular SYSTEM token behaviors to detect potential exploitation attempts.
Based on reporting by Cyber Security News.