PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation

A critical local privilege escalation (LPE) vulnerability affecting Microsoft Windows has recently come to light following the public release of a Proof-of-Concept (PoC) exploit.

Tracked as CVE-2026-20817, this security flaw resides within the Windows Error Reporting (WER) service.

The vulnerability allows an authenticated user with low-level privileges to execute arbitrary malicious code with full SYSTEM privileges.​

The detailed research and the accompanying C++ PoC exploit were published on GitHub by security researcher @oxfemale (also known as @bytecodevm on X/Twitter).

The release highlights a significant security gap in Windows’ error-reporting mechanisms for interprocess communication.​

The core of this vulnerability involves the Advanced Local Procedure Call (ALPC) protocol.

The WER service exposes a specific ALPC port named \WindowsErrorReportingService to facilitate communication with other processes.

According to the researcher’s findings, the flaw specifically exists in the SvcElevatedLaunch method, identified as method 0x0D. The WER service completely fails to properly validate the calling user’s permissions.

As a result, an attacker can force the service to launch WerFault.exe using custom command-line parameters supplied from a shared memory block.

Exploit Execution Steps

To successfully trigger the exploit, an attacker follows a straightforward sequence of actions:

Action	Description
Create Shared Memory	Create a shared memory block containing an arbitrary, malicious command line.
Connect to WER ALPC Port	Establish a local connection to the Windows Error Reporting (WER) ALPC port.
Send ALPC Message (Method 0x0D)	Send an ALPC message using method 0x0D, including the client process ID, the shared memory handle, and the exact command-line length.
Trigger Command Execution	The WER service duplicates the handle and launches WerFault.exe with the supplied command line.

Because the WER service runs at a high-privilege level, the newly spawned process inherits the SYSTEM token.

This token includes dangerous permissions, such as SeDebugPrivilege (which allows debugging any process) and SeImpersonatePrivilege (which allows impersonating any user).

While it does not grant SeTcbPrivilege to act as part of the operating system itself, the obtained privileges still provide full system access.​

The vulnerability impacts a wide range of operating systems. This includes all versions of Windows 10 and Windows 11 before January 2026, as well as enterprise server environments running Windows Server 2019 and Windows Server 2022.

Microsoft officially addressed this vulnerability in the January 2026 Security Update.

According to the PoC published on GitHub, organizations and system administrators are strongly advised to apply the latest security patches immediately to secure their networks.

Security teams should also monitor their environments for unusual WerFault.exe child processes and irregular SYSTEM token behaviors to detect potential exploitation attempts.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.