Windows 11 Get Help flaw let standard users seize full control, and Microsoft fixed it without a CVE

A flaw in the Get Help troubleshooting platform in Windows 11 could have let an ordinary user take full control of a PC. Microsoft fixed the problem quietly and did not issue CVE identifiers, the standard public references used to track vulnerabilities.

Ben Wilson of Melbourne's Tanto Security examined Get Help, which runs troubleshooting packages made up of PowerShell scripts hosted by Microsoft. These are processed by the Diagnostic Execution Service, which runs with SYSTEM privileges, the highest level on a Windows computer. Older troubleshooters asked for administrator approval, but on Windows 11 Wilson found any standard user could launch the service with no prompt. One package fetched Microsoft's Media Creation Tool and ran it as SYSTEM from a temporary folder that ordinary users could write to. Wilson used two race conditions, brief timing windows where the order of events can be manipulated, to take control of that folder and swap the genuine executable for his own program.

Wilson reported the bug to the Microsoft Security Response Centre on May 13. Microsoft confirmed the behaviour on June 29 and awarded a bounty the next day. The fix arrived around September 1, and Wilson only learned of it while preparing a demonstration for a talk. He said Microsoft changed one line in the PowerShell script to stop users gaining full control permissions over the download folder, which blocks overwriting the legitimate tool. He has yet to establish whether the patch can be sidestepped.