Windows Error Reporting EUVD-2026-99343

Exploitation requires an attacker who already holds a valid, low-privileged authenticated account with local access to the Windows host (AV:L, PR:L); it is not remotely reachable over the network. The specific prerequisite is the ability to invoke the affected Windows Error Reporting critical function, which lacks an authentication check (CWE-306), so no non-default configuration or feature toggle is stated as required - WER is present by default in all supported Windows editions. No user interaction is required (UI:N). The principal limiting factor is the mandatory pre-existing local foothold, which prevents direct external or unauthenticated exploitation and narrows realistic use to local attackers or post-compromise privilege escalation.

Signals are internally consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 7.1) describes a locally exploitable flaw that already requires a low-privileged authenticated foothold on the host, which caps real-world urgency despite the HIGH confidentiality and integrity impact. CISA SSVC reinforces this: Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation path, though Technical Impact=total matches the C:H/I:H rating. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' EPSS was not provided in the input and therefore cannot be used to estimate exploitation probability. One tension to verify: the description characterizes the defect purely as 'tampering' (an integrity concern via CWE-306 missing authentication), yet the CVSS vector also asserts C:H confidentiality impact - the confidentiality dimension is not explained by the description and should be confirmed against the Microsoft advisory. Net assessment: a legitimate patch-in-normal-cycle local privilege/tampering issue on an enormous install base, not a high-CVSS-but-illusory-risk item, but also not a drop-everything remote threat.

A low-privileged but authenticated local user on a Windows system invokes a Windows Error Reporting function that is missing an authentication check, letting them tamper with data and access information they should not reach, plausibly as a local privilege-escalation or security-control-bypass primitive. No public proof-of-concept or exploit code is identified in the provided data, and exploitation requires the attacker to already have a local account and access to the host.