Windows Error Reporting EUVD-2026-73516

Exploitation requires a local, authenticated session with at minimum a standard (low-privilege) user account on the affected Windows system - remote unauthenticated exploitation is not possible given AV:L/PR:L. The attacker must be able to enumerate or predict the WER temporary directory path and create symlinks or directory entries within it, which is possible for any normal user account on affected builds. No special application configuration, non-default feature enablement, or elevated rights are required beyond having an interactive or remote-desktop session. What limits exploitation: the attacker must already have local code execution as a low-privileged user, making this a post-compromise escalation primitive rather than an initial-access vector; exploitation is also constrained to moments when WER is actively processing a crash report.

The CVSS vector (AV:L/AC:L/PR:L/UI:N) accurately describes a local, low-complexity attack requiring only a standard user account - attack complexity is genuinely low because symlink races against WER temp-file creation are mechanistically straightforward on Windows. The combined C:H/I:H impact reflects the dual risk: an attacker can both read sensitive crash-dump fragments and redirect WER output writes to arbitrary locations, potentially enabling privilege escalation chains. EPSS data was not provided in the source intelligence, but given the local-only attack vector and the need for an existing user account, the realistic exploitation window is constrained to insider threats, post-compromise lateral movement, or situations where an adversary already has a foothold with low-privilege access. The wide affected-version spread - from Windows Server 2016 through Windows 11 26H1 - means the patch surface is large, and any Windows environment running unpatched builds across this range is exposed. No public exploit code and no CISA KEV listing further indicate that opportunistic mass exploitation is not occurring at time of analysis, though the straightforward attack complexity means a functional exploit could be developed quickly. The availability of a vendor patch makes remediation the priority over compensating controls.

A standard domain user on a multi-user Windows system monitors the WER temporary directory and pre-creates a symlink or junction pointing to a sensitive system file or attacker-controlled path. When WER next processes a crash report, it follows the symlink, either writing crash-dump fragments to the attacker's chosen location or exposing sensitive data held in the temp file to the unprivileged user. No public exploit code has been identified at time of analysis, but the attack mechanics are well-understood from prior CWE-379 disclosures on Windows.