Exploitation Summary
CVE-2019-0863 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 1 public exploit from researchers including SandboxEscaper.
AI-analyzed exploit summary This exploit leverages a race condition in the Windows Error Reporting (WER) service to arbitrarily write DACLs to files, achieving local privilege escalation (LPE). The PoC involves creating a junction point, triggering the WER reporting queue, and replacing a file with a hardlink during a small timing window between GetFileSecurity and SetFileSecurity calls.
Description
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
Exploits (1)
This exploit leverages a race condition in the Windows Error Reporting (WER) service to arbitrarily write DACLs to files, achieving local privilege escalation (LPE). The PoC involves creating a junction point, triggering the WER reporting queue, and replacing a file with a hardlink during a small timing window between GetFileSecurity and SetFileSecurity calls.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H