Windows Error Reporting CVE-2026-85800

Exploitation requires the attacker to already be executing code locally on the target host with at least standard-user (low) privileges - the vector is AV:L/PR:L, so this is strictly a local privilege-escalation primitive, not a remote-access vulnerability. The attacker must interact with the Windows Error Reporting (WER) subsystem to trigger the heap-based buffer overflow; no end-user interaction is needed (UI:N). The chief limiting factors are the need for prior local access and valid low-level authentication/session, which means this flaw is only useful as a post-compromise escalation step (e.g., chained after an initial RCE or credential theft). Affected systems span the full supported Windows line (Windows 10/11, Server 2012 through 2025, including Server Core); patched builds are enumerated in the EUVD affected-version ranges, so unpatched hosts below those build numbers are the exposed population.

This is a genuine but second-tier priority - a local privilege escalation with high technical impact but meaningful barriers to exploitation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local access and low-level (authenticated) privileges on the host, meaning this is not a remote entry point but a post-compromise escalation primitive. All three impact metrics are High (C:H/I:H/A:H) and SSVC rates Technical Impact as 'total,' consistent with a full SYSTEM-level takeover via the Windows Error Reporting component. However, the real-world exploitation signals are notably cool: CISA SSVC lists Exploitation as 'none' and Automatable as 'no,' there is no CISA KEV listing, and no public POC is indicated in the provided data. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. The signals are internally consistent rather than conflicting: a high-impact-but-not-yet-exploited local EoP. For patch prioritization this should be treated as important (it chains with any initial-access or RCE bug to achieve SYSTEM), but it is not an emergency on the level of a wormable or actively-exploited remote flaw. Note that 'authorized attacker' in the description aligns with PR:L in the vector, confirming authentication is required.

An attacker who already has a low-privileged foothold on a Windows host - for example via phishing, a malicious document, or stolen standard-user credentials - runs a crafted local process that triggers the heap-based buffer overflow in the Windows Error Reporting (WER) service. By corrupting heap memory in a higher-privileged context, the attacker escalates from a standard user to SYSTEM. No public exploit or active exploitation is indicated at time of analysis, and no user interaction is required (UI:N).