Skip to content

feat(native): attach WER report - #1777

Closed
jpnurmi wants to merge 30 commits into
masterfrom
jpnurmi/feat/native/wer
Closed

feat(native): attach WER report#1777
jpnurmi wants to merge 30 commits into
masterfrom
jpnurmi/feat/native/wer

utf8

5c812aa
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed Jun 3, 2026 in 3m 59s

1 issue

Low

DLL search-order hijacking via unqualified LoadLibraryW("wer.dll") - `src/backends/native/sentry_crash_daemon.c:2243`

resolve_wer() loads wer.dll by bare name without LOAD_LIBRARY_SEARCH_SYSTEM32, so the default DLL search order looks in the crash daemon's application directory before System32. If the daemon is installed in a directory writable by a lower-privileged local user (common for per-user installs), a planted wer.dll will be loaded and executed in the daemon's process. Use LoadLibraryExW(L"wer.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32) to pin resolution to the system directory.

1 skill analyzed
Skill Findings Duration Cost
security-review 1 3m 4s $1.09

⏱ 3m 4s · 564.9k in / 19.9k out · $1.09