Local privilege escalation via predictable WER temp file

File-operation race in Microsoft Windows Error Reporting allows local users to gain SYSTEM privileges through a predictable temporary file. The WER service creates a name with GetTempFileNameW in a user-writable Temp directory, closes its handle, and later writes to and deletes that path. A low-privilege authenticated user must win the race with filesystem links; successful exploitation redirects SYSTEM-level file operations and enables arbitrary file deletion leading to elevation.