Windows Error Reporting EUVD-2026-72982

Exploitation requires a low-privileged authenticated local session on the target Windows system (PR:L, AV:L per CVSS vector). Windows Error Reporting is enabled by default in all affected Windows editions and requires no special feature activation or non-default configuration. Exploitation is strictly local - no network exploitation path exists per the AV:L metric. Attackers without any form of local system access (e.g., those limited to external network access only) cannot directly exploit this vulnerability. No user interaction is required beyond the attacker's own actions once local access is established.

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N accurately characterizes a local privilege escalation requiring only a standard low-privileged user account with no special conditions. The low attack complexity and absence of user interaction requirements make this reliable once an attacker has established local access. No EPSS data was provided in the available intelligence, but the combination of AC:L and a ubiquitous target surface means any organization with Windows environments should treat this as a priority patching item - even a mid-sized municipal IT team would be exposed across its entire Windows fleet if unpatched. The absence of a CISA KEV listing and lack of public exploit code moderates immediate urgency; however, local privilege escalation primitives in core OS components historically see rapid weaponization in post-exploitation frameworks and ransomware toolchains. The breadth of affected versions (19 distinct product/version combinations) is notable and increases aggregate organizational exposure substantially.

An attacker who has gained a low-privileged foothold on a Windows system - through phishing, credential theft, or lateral movement - invokes or triggers the Windows Error Reporting subsystem in a crafted manner to induce the out-of-bounds read. The read discloses kernel memory contents or corrupts adjacent heap structures, which the attacker then leverages to redirect execution and escalate to SYSTEM privileges. No public proof-of-concept has been identified at time of analysis, but the low attack complexity suggests the trigger is straightforward for a motivated attacker who has already achieved local access.