Windows Error Reporting CVE-2026-83658

Exploitation requires an attacker to already have a local, authenticated foothold on the target Windows host with low privileges (AV:L, PR:L) and the ability to interact with the Windows Error Reporting service/component; there is no remote vector and no user interaction is needed (UI:N). Limiting factors: the attacker must first obtain valid low-privileged credentials or a running session on the machine, and the impact is confined to confidentiality (C:H, I:N, A:N) - the flaw neither modifies data nor affects availability, and it cannot be triggered across a network. Affected systems are Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the patched build levels listed in EUVD-2026-99319.

This is a moderate, locally-exploitable information disclosure flaw (CVSS 5.5) in Windows Error Reporting (WER). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and CISA's SSVC assessment agree on a low-urgency picture: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact only 'partial', which is consistent with a local, authenticated, confidentiality-only bug that cannot be mass-automated across the internet. No KEV listing and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be compared here. The signals are internally consistent - nothing conflicts - and point to a real but non-urgent issue: it requires prior local access with low privileges (PR:L) and yields high confidentiality impact but no integrity or availability impact. One metadata caveat: the input Tag 'Authentication Bypass' conflicts with the actual weakness class (CWE-862 Missing Authorization / improper access control leading to information disclosure); this is not an authentication bypass and the tag appears mislabeled. Priority should be routine patch-cycle remediation rather than emergency response, weighted up only by the ubiquity of Windows.

A low-privileged authenticated user already on a Windows host abuses improper access control in Windows Error Reporting to read error-reporting data they should not be permitted to access, disclosing sensitive information such as memory contents or data belonging to other users or higher-privileged processes. No public exploit code was identified, and the attack is strictly local (AV:L) requiring an existing foothold with low privileges.