CVE-2019-1315

Windows Error Reporting (WER) Manager improperly handles hard links (CWE-59, link following), allowing a local attacker with low privileges to redirect privileged file operations performed by the service. By planting a hard link that points at files WER operates on, the attacker can get the service to act on attacker-controlled content in a privileged context, with no user interaction required. Successful exploitation grants elevation of privilege on the local machine — commonly to SYSTEM — with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L). Users of Windows 7, 8.1, and RT 8.1, Windows 10 builds 1607 through 1903, and Windows Server 2008, 2012, and 2016 are affected; this issue is distinct from the related CVE-2019-1339 and CVE-2019-1342. The flaw was fixed in Microsoft's October 2019 Patch Tuesday and was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, so it is being exploited in the wild even though no public proof-of-concept is known.

What to do: Apply Microsoft's October 2019 Patch Tuesday security updates on all affected Windows 7/8.1/10 clients and Windows Server 2008/2012/2016 hosts via Windows Update, WSUS, or SCCM, as required by the CISA KEV catalog. Because CISA reports ransomware operators exploiting this flaw, prioritize domain-joined and internet-reachable servers and verify patch compliance across the estate, focusing on hosts where non-admin users can log on locally. If patching must be delayed, restrict interactive logon rights to trusted low-privilege users, since exploitation requires local access.