Windows Error Reporting EUVD-2026-73230

Exploitation requires a local authenticated session with at least standard (low-privileged) user rights - the CVSS PR:L metric confirms authentication is required and PR:N (unauthenticated) does not apply. The attack vector is AV:L (local), so remote unauthenticated exploitation is not possible; an attacker must either have interactive logon, Remote Desktop, or local service/user-level code execution already. The AC:H metric indicates a race condition or precise timing requirement that must be won for reliable exploitation, meaning a naive single-attempt exploit is unlikely to succeed without retry logic. No specific non-default configuration is described as required - the vulnerability exists in the WER subsystem present on all standard Windows installations. Exploitation is limited by the requirement for local access and the race-condition complexity.

The CVSS 7.0 base score with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a genuinely dangerous local privilege escalation constrained by exploitation complexity. The AC:H metric indicates that reliable exploitation requires winning a race condition or satisfying precise timing constraints, which limits the attack to more technically capable adversaries and reduces the likelihood of mass or automated exploitation. No EPSS data was provided; given the AC:H rating and local-only vector, broad opportunistic exploitation is unlikely, but this is a highly credible post-initial-access escalation primitive for threat actors who have already established a foothold via phishing, service exploitation, or similar means. The breadth of affected platforms - spanning Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - gives this a very large organizational attack surface, making patch deployment a clear priority. No public exploit code exists at time of analysis, and CISA KEV has not listed this vulnerability.

An attacker who has obtained low-privileged local access to a Windows endpoint - for example via a phishing payload or exploitation of an internet-facing application - triggers a race condition in the Windows Error Reporting subsystem by causing concurrent error-report processing events. By timing a memory-freeing path against a dangling-pointer dereference, the attacker reallocates and controls the freed region to redirect execution, ultimately achieving SYSTEM-level code execution. No public proof-of-concept exists at time of analysis, but the technique is well-understood for Windows kernel and service UAF primitives.