Windows Error Reporting EUVD-2026-100011

Requires the attacker to already have authenticated local access to the Windows host with at least low-level privileges (PR:L), per the CVSS vector - this is a local elevation-of-privilege flaw in the Windows Error Reporting component, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so exploitation is reliable once a foothold exists. The primary limiting factor is that remote-only or unauthenticated attackers cannot exploit it directly; it must be chained after initial access. Affected systems are those running pre-patch builds listed in the EUVD data (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 22H2 below 10.0.19044.7807); patched builds are not vulnerable.

This is a credible, patch-now local privilege escalation rather than a hype-driven high-CVSS item. The CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity local attack requiring only low existing privileges and no user interaction, yielding total compromise (C/I/A all High) of the host. The CISA SSVC framework corroborates severity on impact (Technical Impact: total) but materially lowers urgency: Exploitation is rated 'none' (no observed active exploitation) and Automatable is 'no' (consistent with a local-only vector that cannot be worm-like mass-exploited). No KEV listing, no POC, and no EPSS score were provided in the input, so there is no evidence of in-the-wild or public exploit activity at this time. The signals are consistent rather than conflicting: high technical impact but local-only reach and no exploitation evidence. The practical priority is driven by the ubiquity of Windows and the fact that PR:L means any low-privileged user or foothold can attempt escalation; this is a standard 'second-stage' EoP that attackers chain after initial access, so it should be patched promptly even without exploitation evidence. One minor data caveat: the input Tags label this 'Information Disclosure', which conflicts with the description and CWE-1390 (Weak Authentication) elevation-of-privilege framing - treat it as an EoP.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) abuses the weak authentication in the Windows Error Reporting component to run code at a higher privilege level. Because the vector is local with low complexity and no user interaction, exploitation is straightforward once local access exists, though it requires that pre-existing foothold. No public exploit code was identified in the provided data.