Windows Error Reporting EUVD-2026-100417

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no elevated privileges are required; exploitation targets a network-reachable Windows Error Reporting code path. The concrete prerequisite is network reachability of the vulnerable WER service/endpoint from the attacker to the target - limiting factors are therefore network exposure and segmentation: hosts where the relevant WER network path is firewalled, disabled, or not exposed to untrusted networks are not reachable. Because WER is traditionally a local diagnostic component, defenders should confirm with the MSRC advisory exactly which configuration or service exposes the network-facing path, as this determines how many hosts are actually exploitable versus merely running the code.

All provided signals point to a top-tier priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) describes network-reachable, low-complexity, unauthenticated code execution with no user interaction and full confidentiality/integrity/availability impact - the classic 'wormable RCE' profile. There is no conflict between the description ('execute code over a network') and the vector (AV:N). However, several real-world risk signals are MISSING from the input and must not be assumed: no EPSS exploitation-probability score is provided, the vulnerability is NOT listed in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' One point warrants vendor verification: Windows Error Reporting (WER) is historically a local/client-side diagnostic subsystem, so an unauthenticated network attack path is atypical - the AV:N rating should be corroborated against the MSRC advisory to confirm which network-facing WER code path (e.g., a report-submission or collection service) is actually reachable. Net assessment: treat as a genuine high priority for patching given the CVSS profile and ubiquitous platform, while recognizing that the absence of EPSS/KEV/POC data means active exploitation is not demonstrated and prioritization rests on severity and reachability rather than observed in-the-wild activity.

A remote, unauthenticated attacker sends a crafted message to a network-exposed Windows Error Reporting code path, overflowing a heap buffer (CWE-122) and corrupting heap metadata or adjacent structures to hijack control flow. Successful exploitation yields arbitrary code execution in the context of the vulnerable WER process on the target host. No public proof-of-concept or exploit code has been identified in the provided data at the time of analysis.