Beardhammer / CVE-2026-85884

# WPAD LPAC / WHESVC privilege escalation
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85884
This repository contains research and proof-of-concept material for a Windows privilege-boundary issue involving the Windows Health and Optimized Experiences service (`whesvc`) and the Windows Diagnostics Lua engine.
Code running with the relevant diagnostics capability can emit a trusted ETW workflow event containing an attacker-controlled Lua module path. The LocalSystem service consumes that event and executes the module through WinDiag without adequately authenticating the producer or restricting the module to a trusted location.
The complete demonstrated transition is:
 [code] 
## Status
The issue was reproduced on the exact Windows 11 x64 builds documented in the included reports, including builds `26200.8457` and `29617.1000`.
## Minimal demonstration
`Invoke-WhesvcToSystem.ps1` is the simplest local-user demonstration. It does not require a DLL, compiler, or external payload and embeds or downloads nothing. The privileged Lua callback runs the inbox `whoami.exe /user` command through `cmd.exe` and redirects its output to a canary file.
From a standard, non-administrator PowerShell session:
 [code] 
A successful run produces `whoami.exe /user` output containing:
 [code] 
The canary is written to:
 [code] 
The workflow has a minimum tracing interval, so the demonstration normally takes at least 35 seconds.
Remove the canary and any matching temporary Lua modules with:
 [code] 
## Responsible use
This material is provided for defensive research, patch validation, and authorized security testing. Users are responsible for complying with applicable laws and for avoiding disruption to production systems.