Windows Error Reporting EUVD-2026-99159

Exploitation requires the Windows Error Reporting (WER) component to be reachable and triggerable by the attacker, which is a default, built-in Windows subsystem across all affected SKUs, so no special feature toggle is needed. The limiting factors are that the attacker must already have local code-execution ability on the host with at least low-level authenticated privileges (PR:L, AV:L) - this cannot be exploited remotely or by an unauthenticated user - and the target must be an unpatched build below the fixed versions listed in EUVD (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2022 below 10.0.20348.5761). No user interaction is required (UI:N) and attack complexity is low (AC:L).

The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have local access and low-level (authenticated, PR:L) privileges, but attack complexity is low and no user interaction is required, with full confidentiality, integrity and availability impact on the affected system. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation probability signals are absent rather than contradictory - this is a patch-available vendor-reported bug (secure@microsoft.com) with no evidence of active exploitation at time of analysis. Realistically this is a solid second-tier priority rather than an emergency: because it is a local EoP it cannot be used for initial access and is most valuable as a post-compromise step to go from a standard user to SYSTEM, which is a very common pairing with a separate initial-access vulnerability. No key signals conflict; the main gap is the lack of EPSS/KEV/POC data, meaning likelihood of exploitation cannot be quantified and should be treated as unknown-but-plausible given the ubiquity of Windows and Microsoft's own reporting.

An attacker who already has a low-privileged foothold on a Windows host (for example a standard user account obtained via phishing or a separate RCE) runs a crafted process that drives Windows Error Reporting into a heap-based buffer overflow, corrupting heap memory to hijack execution in a higher-privileged context and gain SYSTEM-level control. No user interaction is needed and attack complexity is low, but local access and existing low privileges (PR:L) are prerequisites. No public exploit code is identified at time of analysis.