Windows Error Reporting EUVD-2026-99333

The vulnerable component is Windows Error Reporting (WER) and the flaw is a heap-based buffer overflow (CWE-122) reachable over a network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and low complexity against affected, unpatched Windows builds - but the specific precondition is network reachability of the WER attack surface on the target. Limiting factors: hosts patched to the fixed builds (e.g., Windows 11 24H2 ≥10.0.26100.9711, Server 2022 ≥10.0.20348.5761, Server 2019/Win10 1809 ≥10.0.17763.9376) are not affected, and real-world reachability depends on whether the WER network path is exposed or firewalled - WER is historically a local component, so the exact exposed endpoint should be confirmed from the MSRC advisory before assuming default network exploitability.

Signals are mostly aligned toward high priority but contain one notable tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, scored 9.8) describes remote, unauthenticated, low-complexity exploitation with total C/I/A impact, and CWE-122 (heap buffer overflow) is a classic memory-corruption RCE primitive. CISA SSVC reinforces concern on two of three axes - Automatable: yes and Technical Impact: total - which together indicate a flaw suitable for reliable, scalable exploitation. However, SSVC Exploitation is 'none', meaning no observed exploitation; the vulnerability is NOT in CISA KEV and no POC is indicated in the input, so this is a theoretically high-risk but not-yet-weaponized issue. EPSS score is not provided, so probabilistic exploitation likelihood cannot be factored in - STATE EXPLICITLY: EPSS missing. One data tension worth verifying with the vendor: Windows Error Reporting (WER) is traditionally a local/client-side diagnostic component, yet the description and CVSS both assert network-reachable, unauthorized code execution - the exact network-exposed attack surface (e.g., a WER service endpoint or report-submission path) is not detailed in the available data and should be confirmed against the MSRC advisory. Net assessment: treat as a genuine high priority for patching given automatability, total impact, and ubiquitous Windows footprint, while recognizing no active exploitation is currently confirmed.

A remote attacker reaches a network-accessible Windows Error Reporting code path on an unpatched host and submits crafted, malformed report data that overflows a heap allocation, corrupting memory to achieve arbitrary code execution without authentication or user interaction. SSVC marks the flaw as automatable with total technical impact, so a working exploit could be scripted for mass use, though no public exploit code is identified at time of analysis.