beardhammer/cve-2026-85884PowerShell proof-of-concept demonstrating CVE-2026-85884, a Windows whesvc/WinDiag Lua ETW privilege escalation from low-privileged or WPAD LPAC code to SYSTEM.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85884
This repository contains research and proof-of-concept material for a Windows privilege-boundary issue involving the Windows Health and Optimized Experiences service (whesvc) and the Windows Diagnostics Lua engine.
Code running with the relevant diagnostics capability can emit a trusted ETW workflow event containing an attacker-controlled Lua module path. The LocalSystem service consumes that event and executes the module through WinDiag without adequately authenticating the producer or restricting the module to a trusted location.
The complete demonstrated transition is:
low-privileged or WPAD LPAC code
-> Microsoft.Windows.Diagnostics.Lua ETW event
-> LocalSystem whesvc workflow
-> attacker-controlled Lua module
-> SYSTEM process canary
The issue was reproduced on the exact Windows 11 x64 builds documented in the included reports, including builds 26200.8457 and 29617.1000.
Invoke-WhesvcToSystem.ps1 is the simplest local-user demonstration. It does not require a DLL, compiler, or external payload and embeds or downloads nothing. The privileged Lua callback runs the inbox whoami.exe /user command through cmd.exe and redirects its output to a canary file.
From a standard, non-administrator PowerShell session:
powershell.exe -NoProfile -ExecutionPolicy Bypass `
-File .\Invoke-WhesvcToSystem.ps1
A successful run produces whoami.exe /user output containing:
nt authority\system S-1-5-18
The canary is written to:
%LOCALAPPDATA%\WhesvcL2S\system-canary.txt
The workflow has a minimum tracing interval, so the demonstration normally takes at least 35 seconds.
Remove the canary and any matching temporary Lua modules with:
powershell.exe -NoProfile -ExecutionPolicy Bypass `
-File .\Invoke-WhesvcToSystem.ps1 -Cleanup
This material is provided for defensive research, patch validation, and authorized security testing. Users are responsible for complying with applicable laws and for avoiding disruption to production systems.