Windows Error Reporting CVE-2026-85354

Exploitation requires the attacker to already possess a local, authenticated low-privileged account on the target (CVSS PR:L, AV:L) and to interact with the Windows Error Reporting (WER) subsystem to trigger the use-after-free. No user interaction from a victim is needed (UI:N). The primary limiting factor is high attack complexity (AC:H): because this is a CWE-416 use-after-free, reliable exploitation almost certainly depends on winning a memory-reclamation race, which may require repeated attempts and controlled heap conditions. There are no network-exploitable paths (local access only) and no default remote exposure; risk is concentrated on multi-user, shared, or terminal-server hosts where untrusted users can execute code locally. Patched builds listed in the EUVD matrix (e.g., 10.0.26100.9711 for 24H2, 10.0.17763.9376 for Server 2019) remediate the condition.

This is a moderate-priority local elevation-of-privilege flaw rather than an urgent crisis, and the available signals are mutually consistent on that point. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.0 High) describes a locally exploitable use-after-free that requires an already-authenticated low-privileged foothold and has high attack complexity - typical of a race condition that must be won to control the freed object. CISA's SSVC framework reinforces low immediate urgency: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (local, non-scalable), though Technical Impact is 'total,' matching the C:H/I:H/A:H impact and a likely jump to SYSTEM. There is no EPSS score in the provided data and no KEV listing, so this is NOT confirmed actively exploited; combined with no POC indicator, the real-world exploitation probability is currently low. No signals conflict here - a High CVSS driven by total impact, tempered by local access, low-privilege prerequisite, and high complexity, with no evidence of exploitation. Priority is 'patch in normal cycle' for most environments, elevated for multi-user hosts where untrusted users hold local accounts.

An attacker who already has a low-privileged local account on a Windows host (for example a standard user on a shared workstation, RDP session host, or a foothold gained via another vulnerability) triggers the Windows Error Reporting component in a way that frees an object still in use, then wins a timing race to reclaim and control that freed memory, executing attacker-controlled code with SYSTEM privileges. The high attack complexity (AC:H) means the race may need multiple attempts, and no public exploit code has been identified at the time of analysis.