CVE-2025-55694 — Windows Error Reporting Service Elevation of Privilege Vulnerability
Executive Summary
Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 11 Version 24H2 for ARM64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022, 23H2 Edition (Server Core installation) | 5066780 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5066835 |
Security Update | Yes |
5066780 |
Security Update | Yes |
Patch Diff
Improper access control (CWE-284) in the Windows Error Reporting Service wersvc.dll, local elevation of privilege to administrator (Important, AV:L, AC:L, CVSS 7.8, Exploitation More Likely). Pre-patch, a WER service operation applied improper access control, letting a low-privileged local caller reach functionality it should not and elevate. Binary scope: across the entire October WER binary set (wermgr.exe, faultrep.dll, werfault.exe, werfaultsecure.exe - all self-diffed 0-delta rebuilds for KB5066835) only wersvc.dll carries a real code delta. The wersvc.dll change (diff of 10.0.26100.5074 -> .6899, Oct 14 2025, KB5066835) is small and gated behind the new CFR flag Feature_1201448248: it introduces a permission/capability-bit helper that decodes an object's flags (flags & 6 == 6) and composes an access mask (mask-and-shift of capability bits) - the identifiable access-control primitive for this CVE. The exact enforcement site is consolidated with the companion CWE-20 input-validation fix (CVE-2025-55692) under the same flag and is not separately isolable in the binary; stated at confirmed-changed level. The Feature_Servicing_WerAllowNetworkUser flag was already present pre-patch and is not the October change.
| Function | Address | Change | Note |
|---|---|---|---|
wersvc capability/access-mask helper (added) |
code change |
code (access-control primitive added, CFR-gated) | Added helper decodes object capability flags (flags & 6 == 6) and composes an access mask via mask-and-shift of the capability bits, used to authorize a WER operation. Gated behind Feature_1201448248. Only real code delta across the WER binary set. |
Feature_1201448248 |
gate |
added (CFR gate) | New October CFR flag consolidating the WER access-control (CVE-2025-55694) and input-validation (CVE-2025-55692) hardening; the pre-patch behaviour still ships when disabled. (Feature_Servicing_WerAllowNetworkUser already existed pre-patch and is not the fix.) |
Attack Path
A low-privileged caller reaches a WER operation it should not, elevating privilege
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.
Exploits & PoC
Detection Rules
Acknowledgments
Denis Faiustov and Ruslan Sayfiev with GMO Cybersecurity by Ierae