Windows Error Reporting EUVD-2026-99091

Exploitation requires the attacker to already hold a low-privilege authenticated foothold (PR:L) and to induce user interaction (UI:R) that triggers the vulnerable Windows Error Reporting code path; it is not an unauthenticated, no-interaction remote takeover. The affected component is Windows Error Reporting, present by default across the listed Windows 10/11 and Windows Server 2012 through 2025 builds (including Server Core installations), so no non-default feature needs to be enabled. Limiting factors that reduce real-world risk: the mandatory existing authentication, the required user action, and SSVC's 'Automatable: no' finding, which together make opportunistic or wormable exploitation unlikely. A patch is available from Microsoft; applying the fixed build (per the EUVD version ceilings, e.g. Windows 11 24H2 >=10.0.26100.9445) removes the condition.

This is a moderately serious but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0) describes a network-reachable, low-complexity flaw that nonetheless requires an already-authenticated low-privilege attacker (PR:L) AND user interaction (UI:R), both of which meaningfully raise the bar. All three impact metrics are High, consistent with a successful privilege elevation yielding full control of the host, which aligns with the SSVC 'Technical Impact: total' rating. Crucially, the exploitation signals point AWAY from urgent mass exploitation: SSVC reports 'Exploitation: none' and 'Automatable: no', there is no CISA KEV listing, and no public POC is referenced - so this is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One point worth verifying: the vulnerability is a privilege-elevation bug yet carries AV:N (network attack vector) - this network-based EoP pattern is plausible for Windows Error Reporting but the combination of 'over a network' with an EoP outcome should be confirmed against the Microsoft advisory to understand the exact remote-triggering path. Net assessment: patch on a normal prioritized cadence (it is a privileged-access, totally-impactful Windows flaw) but it does not currently meet the bar for drop-everything emergency response given the authentication requirement, user-interaction requirement, and absence of any observed or automatable exploitation.

A low-privileged but authenticated attacker on the network crafts malicious input that reaches the Windows Error Reporting component and induces a user action (UI:R) that triggers the heap-based buffer overflow. Successful corruption of heap memory lets the attacker execute code in an elevated context, elevating from a limited account to full control of the host. No public exploit code is identified at time of analysis, and SSVC rates exploitation as 'none' and not automatable.