Windows Error Reporting (WER) Local Privilege Escalation Vulnerability (CVE-2023-36874) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-36874) is an elevation of privilege vulnerability that occurs when the Windows Error Reporting (WER) service processes symbolic links or hard links in the local file system. The WER service operates with high privileges (SYSTEM) to collect diagnostic information when system errors occur. By trusting and processing files within directories controllable by low-privilege users without proper validation, a CWE-59 (Improper Link Resolution) vulnerability is introduced, allowing attackers to redirect file operations to protected system areas.

2. Exploitation Mechanics & Attack Scenario

An attacker first gains local access to the target Windows system with standard user privileges. During the triggering of WER report generation and transmission, the attacker creates malicious symbolic links inside temporary directories (e.g., C:\ProgramData\Microsoft\Windows\WER\Temp). When the high-privileged WER service attempts to read or write files at that path, it follows the link to manipulate critical system files in directories like System32. Ultimately, the attacker leverages this file manipulation to perform DLL injection or overwrite system binaries, executing arbitrary payloads with SYSTEM privileges.

3. Infrastructure & Business Impact

With a CVSS score of 7.8, this vulnerability has been actively exploited in the wild and is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog. If exploited by an internal threat actor or malware, it allows complete takeover of individual endpoints and servers within an Active Directory (AD) environment. This can lead to domain controller compromise, ransomware deployment, and sensitive data exfiltration, causing severe business disruption.