Windows Error Reporting CVE-2026-83826

Exploitation requires the attacker to already have local, authenticated code execution at low privilege (PR:L) on an affected Windows 11 (23H2 through 26H2) or Windows Server 2025 host, and to be able to invoke or interact with the Windows Error Reporting component to trigger the untrusted pointer dereference. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-only vector (AV:L) is the primary limiting factor: this cannot be launched remotely and cannot be used for initial access. Applying the available Microsoft patch (e.g., build >=10.0.26100.9711 for 24H2, >=10.0.22631.7652 for 23H2) removes the condition entirely.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N) in Windows Error Reporting with total technical impact (C:H/I:H/A:H), meaning a successful exploit yields full SYSTEM-level compromise. However, the exploitation signals argue against emergency prioritization: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, no EPSS score was provided, and no public exploit is identified. The AV:L vector means an attacker must already have local, authenticated code-execution (PR:L) on the host, so this is a post-compromise privilege-escalation primitive rather than an initial-access or wormable threat. Net assessment: a genuinely impactful but second-stage vulnerability - important to patch on a normal cycle, but not a drop-everything emergency absent evidence of exploitation. Note one data conflict: the input Tags label this 'Information Disclosure', yet the description and CVSS (I:H/A:H) describe a full privilege-elevation with integrity and availability impact, not merely disclosure - the tag appears mislabeled. EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

A low-privileged but authenticated local user (or malware already running in a limited user context after initial access via phishing or a browser exploit) invokes Windows Error Reporting in a way that triggers an untrusted pointer dereference (CWE-822). Because the attack vector is local with low complexity and no user interaction, the attacker reliably escalates from their restricted context to SYSTEM-level privileges. No public proof-of-concept is identified at time of analysis.