CVE-2019-0863

What is Windows Error Reporting?

Windows Error Reporting (WER) is the built-in Windows service that collects crash and diagnostic data from applications and the OS and, with SYSTEM privileges, writes report files and manipulates related paths on disk. Because a component with that level of trust routinely creates and moves files on behalf of unprivileged processes, any flaw in how it validates the files it touches can be turned into an arbitrary file write/corruption primitive by a local attacker.

Overview

CVE-2019-0863 is a High-severity local privilege-escalation vulnerability in Windows Error Reporting caused by the service's improper handling of files during crash-report processing, allowing a local attacker to manipulate WER into corrupting or overwriting arbitrary protected files with SYSTEM-level access. Microsoft fixed it in the May 2019 Patch Tuesday update.

Technical Details

The flaw follows the same general pattern as other privileged file-handling bugs of this era: WER operates on files under partial attacker influence without adequately verifying that the target has not been swapped for something else (such as a symbolic link or hard link to a protected file) before the privileged operation completes. Exploitation requires only local access and low privileges, with no user interaction, and the resulting arbitrary file write/corruption is readily escalated to full SYSTEM code execution — for example, by corrupting or replacing a file loaded by a privileged service.

Discovery

This flaw closely tracks a class of Windows Error Reporting file-corruption bugs publicly demonstrated via proof-of-concept exploits (popularly nicknamed "AngryPolarBearBug") by the pseudonymous researcher SandboxEscaper, who published a series of unpatched Windows local privilege-escalation bugs throughout 2018 and 2019 that pressured Microsoft into faster fix cycles.

Exploitation Context

CISA's KEV catalog confirms this vulnerability has been exploited in the wild. Local privilege-escalation bugs like this are a staple second stage for attackers who have already gained a limited foothold — via phishing, a compromised low-privilege account, or an exploited application — providing the elevation needed to disable security controls, harvest credentials, or move laterally with administrative rights.

Remediation

1. Apply the May 2019 Patch Tuesday cumulative update (or any later update) for the affected Windows version.
2. Restrict local logon and code execution on systems where broad standard-user access isn't required.
3. Monitor for unexpected file corruption or permission changes on system-critical files, a potential indicator of exploitation attempts.
4. Deploy endpoint detection tuned to flag suspicious symbolic/hard-link creation targeting protected directories.
5. Apply least-privilege principles broadly, since this and related 2018–2019 local EoP bugs were frequently chained together by attackers probing multiple techniques.