MiniPlasma WER Windir Hijack via Volatile Environment Registry Key (CVE-2020-17103)

Louis Schürmann@plat0

•updated May 18, 2026•13•0•549

Detects a write to windir under USER\.DEFAULT\Volatile Environment, the core primitive of CVE-2020-17103 (MiniPlasma). Writing windir here causes the WER QueueReporting scheduled task to execute wermgr.exe from an attacker-controlled path as SYSTEM instead of the legitimate C:\Windows\System32\wermgr.exe, achieving local privilege escalation. No legitimate software writes to this key.