Windows Error Reporting EUVD-2026-72978

Exploitation requires an authenticated local user account (PR:L) - no guest or anonymous access is sufficient. The attack vector is strictly local (AV:L), so the attacker must either have physical console access or an existing remote session (e.g., RDP, SSH, previously established reverse shell). No user interaction is required after triggering the vulnerability (UI:N), and no non-default configuration is implied - Windows Error Reporting is enabled by default on all affected Windows SKUs. What limits exploitation: the attacker must already possess a local foothold with at least standard user rights; this is an escalation primitive, not an initial access vector. Unpatched systems across all listed builds from Windows 10 1809 through Windows 11 26H1 are affected.

CVSS 7.8 reflects a realistic local privilege escalation scenario: the attack vector is local (physical or remote shell required as precondition), complexity is low, and a low-privileged account is sufficient. This is a classic LPE-class vulnerability that would typically be chained after initial access - e.g., a remote code execution vulnerability lands a low-privilege shell, then this flaw escalates it to SYSTEM. EPSS data is not provided in the input, so probability of exploitation in the wild cannot be quantified. No CISA KEV listing is present; no public POC is referenced. The wide affected surface (12 distinct Windows SKUs including Server 2019 through 2025) increases aggregate organizational exposure. The patch is confirmed available from the vendor via the Microsoft Security Response Center, which significantly reduces risk for patched systems. Real-world priority: medium-high for environments where initial access controls are weak and lateral movement/privilege escalation is a concern.

An attacker who has gained a low-privileged shell on a Windows endpoint - for example, through a phishing payload or an exploited remote vulnerability - triggers the WER heap overflow by submitting malformed input to the WER processing path, corrupting heap structures to redirect execution into attacker-controlled code. The result is code execution at SYSTEM privilege, granting full control of the machine. No public POC has been identified at time of analysis, but the low-complexity rating suggests the overflow can be triggered reliably without special preconditions.