Microsoft Windows Error Reporting Service Elevation of Privilege Vulnerability Exploit (CVE-2026-97798)

Windows Error Reporting preserves attacker-controlled command-line syntax across a privilege boundary and passes it to the elevated Time Travel Debugging recorder without preserving argument boundaries. The module performs the following steps: Generates a per-run x86_64 Core Impact agent executable with a random name. Stages the exploit and agent beneath a unique directory resolved from the target's public profile. Triggers the vulnerable WER/TTD workflow and preserves the per-run context in a randomly named manifest. Launches the standalone agent as SYSTEM outside the TTD-recorded process tree. Confirms the privileged callback and removes temporary exploit artifacts on a best-effort basis.