CVE-2024-26169: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Error Reporting Service Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
A flaw in Windows Error Reporting Service allows an attacker with local access to gain higher privileges on the system. This means someone who can log in to your computer could potentially take control of it completely.
CWE-269 improper access control in Windows Error Reporting Service enables local privilege escalation. An authenticated attacker can exploit insufficient validation to elevate privileges from a standard user account to system level or administrator level without requiring additional user interaction.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.