Windows Error Reporting CVE-2026-69387

Exploitation requires the attacker to already possess authenticated local access with low privileges (PR:L) on the target Windows system and to interact with the Windows Error Reporting (WER) subsystem. The high attack complexity (AC:H) reflects a required condition the attacker does not control - a race window must be won to trigger the use-after-free, meaning reliable exploitation depends on timing and memory-layout factors. No user interaction is needed (UI:N) and the scope is unchanged (S:U). Limiting factors: no remote vector exists (AV:L), an attacker must first establish a foothold on the host, and the race-condition dependency makes weaponization non-trivial. All currently supported Windows client and server builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761) are affected until patched.

This is a genuinely moderate-priority local elevation-of-privilege flaw, not a critical remote threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms it requires local access and already-authenticated low privileges, and the high attack complexity (AC:H) indicates a non-trivial precondition - characteristic of the race-condition timing windows typical of use-after-free (CWE-416) bugs. The CVSS base score of 7.0 is driven by total impact (C:H/I:H/A:H) rather than ease of exploitation. All three signals that would escalate urgency point downward: CISA's SSVC decision framework records Exploitation as 'none' and Automatable as 'no' (consistent with a local, complexity-gated bug), and there is no public exploit identified at time of analysis. No EPSS score and no KEV listing were provided in the input; absence of these is not evidence of safety but does mean there is no data indicating widespread or active exploitation. The one conflicting signal is the metadata tagging: the description states only privilege elevation, yet the tags include 'Denial Of Service' - a UAF can plausibly cause both DoS and code execution, so this is not necessarily an error, but the authoritative description scopes the impact to EoP, so prioritize on that basis.

A low-privileged user who already has code execution on a Windows host (e.g., via a compromised standard user account or a sandboxed application) triggers the Windows Error Reporting component and wins a race condition to reuse freed memory, corrupting kernel/service state to run code at SYSTEM. Because the CVSS vector specifies high attack complexity (AC:H), the attacker must reliably hit a narrow timing window, which reduces the practicality of the attack. No public exploit code has been identified at time of analysis.