RoguePlanet: Exclusive Byte-Range Lock on VSS wermgr.exe Path (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized attempts to place an exclusive byte-range lock on the wermgr.exe executable when accessed via Volume Shadow Copy (VSS) or temporary paths, which is characteristic of the RoguePlanet exploit. This technique is designed to stall Windows Defender's clean-up operations, creating a time-of-check to time-of-use (TOCTOU) race window for further exploitation.