Windows Error Reporting CVE-2026-69896

Exploitation requires an authenticated low-privileged local user account on the vulnerable Windows system (PR:L from CVSS). The attack complexity is high (AC:H), meaning the attacker must overcome a race condition or specific memory-layout constraint - exploitation is not reliable without tooling or multiple attempts. No user interaction from a victim is required once the exploit is staged (UI:N). The vulnerability is confined to local access (AV:L); network-accessible attack paths are not established. Affected configurations are Windows 11 Version 24H2/25H2/26H1 and Windows Server 2025 running unpatched builds. Systems already patched to the fix build thresholds listed in the EUVD are not vulnerable.

Real-world risk is moderate-to-high for environments where untrusted local users can run code on affected Windows 11 or Server 2025 endpoints - multi-user systems, shared workstations, terminal servers, and VDI environments are the primary concern. The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation is not trivial: the AC:H metric indicates a race condition or precise heap-layout requirement, raising the bar compared to straightforward LPE bugs. EPSS data is not provided; without a public exploit, opportunistic mass exploitation is unlikely, but skilled threat actors with established local footholds would find this a valuable stepping-stone to SYSTEM. No CISA KEV listing and no POC are identified, which collectively deprioritize this relative to actively-exploited LPE bugs, though the full-triad impact (C:H/I:H/A:H) means successful exploitation yields complete system compromise. Defenders should prioritize patch deployment on multi-user servers and workstations with shared access, as single-user home endpoints present lower marginal risk from this class of vulnerability.

An attacker with a low-privileged local account on a shared Windows Server 2025 terminal server triggers a race condition in WER's memory management - for example, by repeatedly causing or simulating crashes that drive WER to allocate and free memory - until a freed object is reclaimed with attacker-controlled content. When WER subsequently dereferences the stale pointer, execution is redirected to attacker code running in WER's elevated context, yielding SYSTEM-level privileges. No public POC has been identified; successful exploitation requires non-trivial heap-grooming or timing control.