PROGRAM DESCRIPTION

The Microsoft Windows Insider Preview bounty program invites eligible researchers across the globe to find and submit vulnerabilities that reproduce in the latest Windows Insider Preview (WIP) Dev Channel. Qualified submissions are eligible for awards from $500 USD to $100,000 USD.

Bounties will be awarded at Microsoft’s discretion. Microsoft may award more depending on the severity and impact of the vulnerability, and the quality of the submission. This bounty program is subject to these terms and those outlined in the Microsoft Bounty Terms and Conditions.  

ELIGIBLE SUBMISSIONS

The goal of the bounty program is to uncover significant vulnerabilities that have a direct and demonstrable impact on the security of customers using the latest version of Windows.

Vulnerability submissions must meet the following criteria to be eligible for bounty awards:

  • Identify a vulnerability that was not previously reported to Microsoft.
  • Such vulnerability must be Critical or Important vulnerability severity
  • You must have tested your submission against the latest Dev Channel version of Windows Insider Preview to demonstrate it is reproducible against that version.
    • Include the build and revision string in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx registry key.
      • For example, 99999.1.amd64fre.fs5_release.180914-1434.en-us
  • Affect a feature that is both serviced and eligible for bounty according to the Windows Security Servicing Criteria.

We request researchers include the following information to help us quickly assess their submission:

  • Include clear, concise, and reproducible steps, either in writing or in video format, providing our engineering team the information necessary to quickly reproduce, understand, and fix the issues
    • Find example reports here.
  • Submit through the MSRC Researcher Portal
  • Indicate in the vulnerability submission which attack scenario (if any) your report qualifies for
  • Describe the attack vector for the vulnerability

GETTING STARTED

To get started, join the Windows Insider Preview program and download the latest Dev Channel version.

For more information, see:

BOUNTY AWARDS

Bounty awards range from $500 up to $100,000. Higher awards are possible, at Microsoft’s sole discretion, based on the severity and impact of the vulnerability and the quality of the submission. Researchers who report vulnerabilities that do not qualify for bounty awards may still be eligible for public acknowledgment if their report leads to a vulnerability fix.

If a reported vulnerability does not qualify for a bounty award under the Attack Scenarios, it may be eligible for a bounty award under General Awards. Eligible submissions will be awarded the single highest qualifying award.

Attack Scenario Awards

 

Attack Vector

Scenario

Maximum Award

Remote (assumes no prior execution)

Unauthenticated non-sandboxed code execution with no user interaction

$100,000

Demonstrated unauthorized access to private1 user data with little2 or no user interaction

$50,000

Data destruction or persistent denial of service with no user interaction

$30,000

Local (assumes prior execution)

Sandbox3 escape with little or no user interaction

$20,000

Demonstrated unauthorized access to private user data from a sandboxed process with no user interaction

$20,000

1Private data means user files, emails, photos or similar data protected behind a Windows security boundary.

2Little user interaction includes, without limitation, clicking a file, browsing to a website, or logging on. 

3Eligible sandboxes are Windows Defender Application Guard RPC broker (HVSIRPCD), New Microsoft Edge based on Chromium renderer process, Windows Defender Sandbox (MsMpEngCP), WinHTTP Web Proxy Auto-Discovery Service (WPAD) sandboxed process, UtcDecoderHost.exe sandboxed process. Ineligible sandboxes are AppContainer (AC) and Internet Explorer sandbox, these are eligible for general bounty awards (see below). 

General Awards

 

Security Impact

Maximum Award

Remote Code Execution

$5,000

Elevation of Privilege

$2,000

Security Feature Bypass

$1,000

Information Disclosure

$1,000

Spoofing

$1,000

Tampering

$1,000

Denial of Service

$500

OUT OF SCOPE SUBMISSIONS AND VULNERABILITIES

Microsoft is happy to receive and review each vulnerability report on a case-by-case basis, but some vulnerability types may not qualify for bounty reward. Here are some of the common low-severity or out of scope issues that typically do not earn bounty rewards: 

  • Any submission that does not demonstrate testing and reproduction in Windows Insider Preview Dev Channel at time of submission
  • Publicly-disclosed vulnerabilities which are already known to Microsoft and the wider security community.
  • Low or Moderate severity vulnerabilities
  • Submissions impacting features not serviced and eligible for bounty according to the Windows Security Servicing Criteria.
  • Vulnerabilities in Windows Store, Windows Apps, firmware, third party drivers, or third-party software in Windows.
  • Vulnerabilities requiring extensive or unlikely user actions.
  • Vulnerabilities that rely on default security settings being downgraded or the system to use uncommon configuration.
    • Vulnerabilities that require enabling Server Message Block protocol (SMBv1)
    • Sandbox escapes with User Account Control (UAC) disabled
  • Vulnerabilities that are only reachable via Microsoft Internet Explorer or Microsoft Edge Legacy. Please use the new Microsoft Edge.  
  • Vulnerability patterns or categories for which Microsoft is actively investigating broad mitigations. As of April 2020, for example, these include, without limitation
    • Local vulnerabilities involving memory corruption due to race conditions in user-mode components such as COM, WinRT or RPC services
    • Local vulnerabilities involving file path redirection through junctions or mountpoints.

ADDITIONAL INFORMATION

For additional information please see our FAQ.

  • If we receive multiple bug reports for the same issue from different parties, the bounty will be granted to the first submission.
  • If a duplicate report provides us new information that was previously unknown to Microsoft, we may award a differential to the duplicate submission. 
  • If a submission is potentially eligible for multiple bounty programs, you will receive the single highest payout award from a single bounty program
  • Microsoft reserves the right to reject any submission at our sole discretion that we determine does not meet these criteria.

REVISION HISTORY

  • July 26, 2017: Program launched
  • January 17, 2019: Added Security Servicing Criteria and updated duplicate report guidelines. Added temporary Windows sandbox escape scope and increased award levels.
  • October 3, 2019: Removed Defender AV sandbox escape bounty bonus. Added How Do I Provide My Report section. 
  • February 10, 2020: Renamed "Bounty Scope" section to "Out of Scope Submissions and Vulnerabilities."
  • April 22, 2020: Added out of scope - vulnerabilities that rely on Microsoft Internet Explorer or Microsoft Edge Legacy and vulnerability patterns or categories for which Microsoft is actively investigating broad mitigations, including examples.
  • July 24, 2020: Added attack scenario awards and general award table, increasing top award to $100,000. Added requirement that eligible submissions must show testing and repro on Dev Channel. Separated submission eligibility into required criteria and recommended criteria.