Windows Error Reporting EUVD-2026-99323

Exploitation requires the attacker to already have local, authenticated low-privilege access (PR:L) to a vulnerable Windows system and to reach the Windows Error Reporting (WER) component that mishandles an uninitialized resource (CWE-908); no user interaction is needed. There is no remote vector - AV:L means the attacker must execute code or hold a session on the target host, which is the primary limiting factor. Affected systems are unpatched builds across Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 below the fixed build numbers listed in EUVD; applying the vendor update remediates the condition.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw requiring an attacker to already hold low-level authenticated access on the host, with low attack complexity and no user interaction, yielding high confidentiality, integrity, and availability impact (score 7.8, HIGH). All signals are internally consistent: the local attack vector matches the description's 'elevate privileges locally,' and CWE-908 (use of uninitialized resource) is a plausible root cause for an EoP primitive. However, the exploitation signals argue against treating this as a top-of-queue item: CISA's SSVC decision points report Exploitation: none, Automatable: no, and Technical Impact: total - meaning no observed exploitation and no reliable mass-automation path, though full system compromise is possible once exploited. There is no KEV listing and no POC indicated in the provided data, so this is 'no public exploit identified at time of analysis.' There is no EPSS score in the input to corroborate exploitation probability. Net: a real, patch-worthy local EoP affecting a ubiquitous platform, best handled in routine Patch Tuesday cadence rather than as an active-threat incident. Note the 'Information Disclosure' tag conflicts with the description, which states privilege elevation - the uninitialized-resource root cause can produce either effect; treat the EoP framing from the description as authoritative.

An attacker who has already obtained a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised service) triggers Windows Error Reporting to operate on an uninitialized resource, leveraging the resulting undefined state to escalate to SYSTEM-level privileges. No user interaction is required and attack complexity is low, but local access is a prerequisite. No public exploit code is identified at the time of analysis.