# CVE-2025-55694 — Windows Error Reporting Service `wersvc.dll` Feature-Gated Access-Control Hardening

---

## Summary

| | |
|---|---|
| **Product** | Windows — `wersvc.dll` (Windows Error Reporting Service / WerSvc) |
| **CVE ID** | CVE-2025-55694 |
| **Impact** | Elevation of Privilege (to administrator) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-284: Improper Access Control |
| **Delivery** | Local — reach the WER service interface with low privilege |
| **KB / Fixed build** | KB5066835 — `wersvc.dll` 10.0.26100.6899 (Win11 24H2 x64) |
| **Patch Date** | October 14, 2025 (2025-Oct) |
| **Pre-patch binary** | `wersvc.dll` 10.0.26100.5074 — SHA256 `11d1e27532b9af49c80894d246ddb874b4d10480aa264843919c22f80b0100f5` |
| **Post-patch binary** | `wersvc.dll` 10.0.26100.6899 — SHA256 `25605f85f49c6d0c791e76fe5b5c4fe33997202f735bddb7c837800e93ebb6cc` |
| **Feature flag** | `Feature_1201448248` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation More Likely; not publicly disclosed; not exploited (per MSRC) |

> Companion: the same October WER servicing change also addresses **CVE-2025-55692**
> (CWE-20 improper input validation). Both are consolidated under the single feature
> gate `Feature_1201448248`; see the note below on isolability.

---

## Product Description

`wersvc.dll` is the **Windows Error Reporting Service** (WerSvc), which brokers error
reports, hung-app reports, and dump collection for local callers. Access to its
operations is governed by capability/permission bits evaluated in the service.

---

## Vulnerability Summary

Pre-patch, the Windows Error Reporting service applied **improper access control**
(CWE-284) to a WER operation, allowing a low-privileged local caller to reach
functionality it should not, and thereby elevate to administrator (per the MSRC FAQ).

> Confirmation level — binary scope. Across the whole October WER binary set
> (`wermgr.exe`, `faultrep.dll`, `werfault.exe`, `werfaultsecure.exe`, …) only
> `wersvc.dll` carries a real code delta for KB5066835; the other WER binaries are
> 0-delta rebuilds. The `wersvc.dll` change is small and **feature-gated behind
> `Feature_1201448248`**: it introduces a **permission/capability-bit helper** that
> decodes an object's flags (`flags & 6 == 6`) and composes an **access mask**
> (mask-and-shift of the capability bits), i.e. an access-control primitive — the
> identifiable artifact of this CWE-284 fix. The exact enforcement site is consolidated
> with the companion CWE-20 fix under the same flag and is not separately isolable in
> the binary; stated at confirmed-changed level.

---

## Prerequisites and Constraints

- Local, low-privileged (`AV:L`, `AC:L`, `PR:L`): invoke the WER service operation.
- Result (pre-patch): access to a WER capability that should have been denied,
  yielding elevation to administrator.

---

## Vulnerability Details

### Root Cause

A WER operation's access decision did not correctly restrict a low-privileged caller,
so functionality that should require higher privilege was reachable.

### The patch (confirmed — diff, .5074 → .6899)

The October `wersvc.dll` update introduces `Feature_1201448248` and, gated behind it, a
**capability/access-mask helper**:

```c
// wersvc.dll (10.0.26100.6899) — PATCHED helper (from the diff)
in_RDX[0] = 0; in_RDX[1] = 0;
flags = *(uint*)this;
*in_RDX = flags;
if ((flags & 6) == 6) { ... }                     // capability bits check
mask = (((cap & 3) << 2 | cap & 0x40) << 2 | cap & 0x80) * 8;   // compose access mask
if ((cap & 0xffffff3f) == 0)      mask |= 0x40;
else if ((cap & 0xffffff3f) == 2) mask |= 0x40;
if ((mask & 0xc00) == 0xc00) { /* required capability present */ }
```

This helper decodes an object's capability flags and builds the access mask used to
authorize the WER operation — the access-control tightening for this CVE, active only
when `Feature_1201448248` is enabled.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1201448248`.** The access-control helper (and the companion
input-validation fix) run only when the flag is enabled; the pre-patch behaviour still
ships when disabled. Verify `Feature_1201448248` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Low-privileged processes invoking WerSvc operations they would not
normally use, followed by privilege gain, on unpatched/flag-disabled builds. The other
WER binaries (`wermgr.exe`, `faultrep.dll`, `werfault*.exe`) are unchanged by this
update — focus on `wersvc.dll` / the WerSvc service.

**Config.** The fix is CFR-gated — confirm `Feature_1201448248` is enabled.

---

## References

- MSRC advisory — CVE-2025-55694 (Windows Error Reporting Service Elevation of Privilege), released 2025-10-14, KB5066835.
- Companion: CVE-2025-55692 (same binary/update, CWE-20 improper input validation).
- Full binary diff: `/data/patch_diffs/wersvc_dll-cve-2025-55694-55692-ghidriff.md`