Windows Error Reporting EUVD-2026-72970

The attacker must hold an authenticated local session on the target Windows system with at minimum standard (non-administrator) user privileges, consistent with the CVSS PR:L metric. Windows Error Reporting is enabled by default on all affected Windows versions and requires no special configuration to be exploitable - no non-default feature enablement is implied as a prerequisite. No user interaction beyond the attacker's own actions is required (UI:N). Exploitation is strictly local (AV:L): a remote attacker must first establish local code execution via a separate vector before leveraging this vulnerability. Any interactive user, Remote Desktop session, compromised service account, or low-privilege process running on the affected host represents a viable attack launchpad. The attack does not cross process isolation boundaries to other systems (S:U), so a compromised host does not directly endanger adjacent systems through this vulnerability alone.

The CVSS 7.8 score is well-calibrated for this class of local privilege escalation: AC:L confirms no timing dependency or special environmental race condition is needed, PR:L means any standard domain or local user account can attempt exploitation, and the full C:H/I:H/A:H triad reflects SYSTEM-level access upon successful heap corruption. EPSS data was not included in the source intelligence, preventing a precise probability-of-exploitation estimate. No CISA KEV listing and no publicly available proof-of-concept code have been identified at time of analysis, placing current observed exploitation risk in the low-to-unknown range. The unchanged scope (S:U) limits direct blast radius to the compromised host, but in ransomware and APT intrusion chains where initial access is already established, local privilege escalation primitives of this type are consistently leveraged within hours of foothold. The twelve-version platform breadth - spanning consumer and enterprise Windows releases from 2018 (1809) through current preview builds (26H1) - creates enormous aggregate exposure; organizations with large unpatched Windows estates should treat this as urgent regardless of current KEV status.

An attacker who has obtained a standard-user session on a Windows host - through phishing, credential stuffing, or lateral movement from a compromised adjacent system - submits a crafted error report or triggers a controlled application crash to invoke the WER heap allocation path. The overflow corrupts adjacent heap structures within the privileged WER process, enabling controlled code execution at SYSTEM privilege. No public proof-of-concept has been identified at time of analysis.