Windows Error Reporting CVE-2025-55694

Exploitation requires the attacker to already possess authenticated low-privileged access (PR:L) and the ability to execute code locally (AV:L) on an affected host - Windows 11 24H2, Windows 11 25H2, or Windows Server 2025. The flaw is in the Windows Error Reporting component, which is present by default, so no special feature toggle is indicated by the description. The primary limiting factor is the need for a pre-existing local foothold: this cannot be triggered remotely or by an unauthenticated actor, which materially reduces its utility as an initial-access vector and positions it as a post-compromise escalation tool.

This is a legitimately prioritizable local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description - 'authorized attacker' maps to PR:L (a low-privileged local user), and 'elevate privileges locally' maps to AV:L with full H/H/H impact. No SSVC decision data or automatable flag was supplied in the input. EPSS is 3.03% but sits at the 87th percentile, which is elevated for a product of this scale; this reflects the general exploitability expectation for Windows EoP flaws rather than confirmed activity. Critically, the input contains NO KEV entry and NO POC indicator, so this is not confirmed to be actively exploited - the signals indicate a credible but not yet weaponized local EoP. One data conflict to note: the input Tags include 'Authentication Bypass,' but the description and CWE-284 describe an improper-access-control privilege escalation by an already-authorized user, not an authentication bypass - verify tag accuracy. As a local EoP it requires a foothold first, so it is a second-stage risk (post-compromise / malicious insider) rather than a remotely exposed entry point.

An attacker who already has low-privileged code execution on a Windows 11 24H2/25H2 or Windows Server 2025 host (via phishing, a prior exploit, or stolen user credentials) abuses the improper access control in Windows Error Reporting to escalate to SYSTEM. No user interaction is required and attack complexity is low (AC:L), making the escalation reliable once a foothold exists. No public exploit identified at time of analysis.