CVE-2023-36874: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Error Reporting Service Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
A vulnerability in Windows Error Reporting Service allows an attacker to gain higher privileges on a Windows system. An attacker who already has limited access can exploit this flaw to gain administrator-level control.
CWE-59 (Improper Link Resolution Before File Access) in Windows Error Reporting Service enables local privilege escalation through insecure file or symbolic link handling. The attack requires local access but can result in SYSTEM-level privileges without user interaction.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.