Windows Error Reporting EUVD-2026-99434

Exploitation requires the attacker to already be an authenticated local user (PR:L) with the ability to run code on the target and interact with the Windows Error Reporting (WER) subsystem; no user interaction is needed (UI:N). The key limiting factors are: local-only access (AV:L - not remotely reachable over a network), prior low-privilege authentication, and high attack complexity (AC:H) because reliably exploiting a double free typically demands winning a timing race and precise heap manipulation. There is no special non-default configuration named in the description - the WER component is a standard Windows feature present in all affected client and server builds - so the practical gate is local foothold plus exploitation skill rather than an opt-in setting.

This is a genuinely moderate-priority local vulnerability rather than a widespread emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a double free (CWE-415) requiring local access, existing low-level privileges, and high attack complexity, yielding total CIA impact in an unchanged scope. All three real-world exploitation signals point the same direction and are consistent: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, and no public exploit code was provided - so this is not under active or scalable exploitation. SSVC Technical Impact 'total' aligns with the C:H/I:H/A:H impact. The AC:H rating is notable: double-free exploitation typically requires winning a race or precise heap-grooming, which depresses real-world exploitability despite the high impact. EPSS was NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals do not conflict - high impact but local-only, privileged, high-complexity, and no evidence of exploitation - making this a solid patch-in-cycle item (local privilege escalation / code execution) rather than a drop-everything network-facing threat. One metadata inconsistency to verify: the CVE is tagged 'Information Disclosure' yet the description and impact metrics describe local code execution (elevation of privilege), so the tag appears mislabeled.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via a standard user account or a compromised low-integrity process) triggers the double free in the Windows Error Reporting component to corrupt heap memory. By winning the required race/heap-grooming conditions (reflected in the high attack complexity), they achieve arbitrary code execution at elevated privilege locally. No public proof-of-concept was identified at the time of analysis, and no user interaction is required.