# CVE-2025-55692 — Windows Error Reporting Service `wersvc.dll` Feature-Gated Input-Validation Hardening

---

## Summary

| | |
|---|---|
| **Product** | Windows — `wersvc.dll` (Windows Error Reporting Service / WerSvc) |
| **CVE ID** | CVE-2025-55692 |
| **Impact** | Elevation of Privilege (to administrator) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-20: Improper Input Validation |
| **Delivery** | Local — supply crafted input to the WER service operation |
| **KB / Fixed build** | KB5066835 — `wersvc.dll` 10.0.26100.6899 (Win11 24H2 x64) |
| **Patch Date** | October 14, 2025 (2025-Oct) |
| **Pre-patch binary** | `wersvc.dll` 10.0.26100.5074 — SHA256 `11d1e27532b9af49c80894d246ddb874b4d10480aa264843919c22f80b0100f5` |
| **Post-patch binary** | `wersvc.dll` 10.0.26100.6899 — SHA256 `25605f85f49c6d0c791e76fe5b5c4fe33997202f735bddb7c837800e93ebb6cc` |
| **Feature flag** | `Feature_1201448248` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation More Likely; not publicly disclosed; not exploited (per MSRC) |

> Companion: the same October WER servicing change also addresses **CVE-2025-55694**
> (CWE-284 improper access control). Both are consolidated under the single feature gate
> `Feature_1201448248`.

---

## Product Description

`wersvc.dll` is the **Windows Error Reporting Service** (WerSvc), brokering error/hung-app
reports and dump collection for local callers over its service interface, which accepts
caller-supplied parameters.

---

## Vulnerability Summary

Pre-patch, the Windows Error Reporting service performed **improper input validation**
(CWE-20) on data supplied to a WER operation, which a low-privileged local caller could
abuse to elevate to administrator (per the MSRC FAQ).

> Confirmation level — not separately isolable. This CVE was fixed **in the same
> October `wersvc.dll` servicing change as CVE-2025-55694**, gated behind the single flag
> `Feature_1201448248`. The whole October WER binary set (`wermgr.exe`, `faultrep.dll`,
> `werfault.exe`, `werfaultsecure.exe`, …) is otherwise 0-delta; the only `wersvc.dll`
> code artifact is a capability/permission-bit helper (see CVE-2025-55694). A **distinct
> input-validation routine for this CVE is not separately identifiable** in the binary —
> the two fixes are consolidated under one flag. This RCA documents the CVE accurately
> per MSRC and records the shared, feature-gated fix rather than asserting a separate
> code patch that the diff does not isolate.

---

## Prerequisites and Constraints

- Local, low-privileged (`AV:L`, `AC:L`, `PR:L`): invoke the WER service operation with
  crafted input.
- Result (pre-patch): improperly-validated input drives the operation to a
  privilege-elevating outcome.

---

## Vulnerability Details

### Root Cause

Input supplied to a WER service operation was not adequately validated before use.

### The patch (confirmed — diff, .5074 → .6899)

The October `wersvc.dll` update introduces `Feature_1201448248` and its associated
capability/permission handling (shared with CVE-2025-55694). The input-validation
tightening for this CVE ships within that same flag-gated servicing change; the binary
diff does not expose a separate, independently-isolable validation function for it. See
`/data/patch_diffs/wersvc_dll-cve-2025-55694-55692-ghidriff.md` for the shared diff.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1201448248`.** The hardening runs only when the flag is
enabled; the pre-patch behaviour still ships when disabled. Verify `Feature_1201448248`
is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Low-privileged processes submitting malformed input to WerSvc
operations, followed by privilege gain, on unpatched/flag-disabled builds. Only
`wersvc.dll` changed in this update; the other WER binaries are unchanged rebuilds.

**Config.** The fix is CFR-gated — confirm `Feature_1201448248` is enabled.

---

## References

- MSRC advisory — CVE-2025-55692 (Windows Error Reporting Service Elevation of Privilege), released 2025-10-14, KB5066835.
- Companion: CVE-2025-55694 (same binary/update, CWE-284 improper access control).
- Full binary diff: `/data/patch_diffs/wersvc_dll-cve-2025-55694-55692-ghidriff.md`