Windows Error Reporting CVE-2026-83996

The attacker must have an authenticated local session on the target Windows system with at minimum low-privileged (standard user) access - PR:L per the CVSS vector. No user interaction from a victim is required (UI:N), and no special non-default configuration is identified as a prerequisite; WER is enabled by default on all affected Windows editions. The primary limiting factor is the requirement for prior local access: this vulnerability is not directly exploitable over the network and presupposes an initial foothold obtained through a separate vector (e.g., malware execution, RDP with compromised credentials, or physical access). Windows Server 2012/2012 R2 deployments that cannot receive patches without an Extended Security Updates (ESU) subscription represent an additional constraint for some organizations.

The CVSS 8.8 score with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H accurately reflects a high-severity local privilege escalation. Low attack complexity (AC:L) means that once an attacker has a foothold on the machine, exploitation does not require special timing, race conditions, or information leaks - a significant aggravating factor. The S:C scope change elevating to C:H/I:H/A:H implies this is effectively a full-system takeover vector from any standard user account. No active exploitation is confirmed by CISA KEV, and no public proof-of-concept exploit has been identified, moderating the immediate urgency somewhat. However, the broad affected surface - stretching from Windows Server 2012 to current Windows 11 and Server 2025 releases - means the blast radius of successful exploitation is enormous. Any organization with Windows endpoints or servers where untrusted or low-privileged code can run should treat this as a priority patch, since local privilege escalation vulnerabilities are a staple of post-compromise kill chains used to pivot from initial foothold to domain dominance.

An attacker with a low-privileged shell on a Windows endpoint - obtained, for example, via a phishing payload executing as a standard user - triggers a heap overflow in the Windows Error Reporting service by sending a specially crafted error report or crash request. The overflow corrupts heap allocator metadata in the WER service process (which runs at elevated privilege), enabling the attacker to redirect execution and achieve SYSTEM-level code execution. No public proof-of-concept has been identified, but the low attack complexity rating indicates the exploit path does not require unusual preconditions beyond the initial foothold.