Windows Error Reporting CVE-2026-69612

Exploitation requires an authenticated local session with at least low-privilege access - a standard domain or local user account is sufficient. The attacker must be able to submit attacker-controlled path data to the Windows Error Reporting subsystem, which is present and enabled by default on all affected Windows versions. No special hardware, non-default configuration, or elevated privilege is required prior to exploitation. Network access is not required; exploitation is strictly local (AV:L), limiting risk to scenarios where an attacker already has interactive or terminal access to the target system. The scope does not change (S:U), so lateral movement to adjacent systems is not a direct consequence of this flaw. Exploitation is further limited by the need for physical or logical access to a session on the target host, which constrains insider threat and post-compromise lateral movement scenarios rather than external network attack paths.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) accurately reflects a local privilege escalation requiring only a valid low-privilege account, no special environmental conditions, and no user interaction - a realistic and low-barrier attack. The full C:H/I:H/A:H triad represents complete local system compromise. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified; this gap should be resolved via NIST NVD or FIRST EPSS lookups before triaging against other vulnerabilities. No CISA KEV listing means confirmed in-the-wild exploitation has not been officially reported. No public exploit code has been identified in the provided data. Despite the absence of active exploitation signals, the low attack complexity combined with the massive deployment footprint - the vulnerability affects every supported Windows version, meaning even a mid-sized IT team in opole running a standard Windows estate faces broad exposure - elevates real-world priority above the raw 7.8 base score might suggest in isolation. Patch availability from Microsoft is confirmed.

A standard domain user on an unpatched Windows workstation crafts an absolute path payload targeting a privileged WER file-handling routine, redirecting a file write operation outside the expected WER working directory into a sensitive system path such as a service binary directory. The overwritten resource is subsequently loaded or executed by a higher-privileged process, granting the attacker SYSTEM-level control of the machine. No public proof-of-concept has been identified, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) indicate the technique would be straightforward for an attacker with knowledge of the WER code path.