Windows Error Reporting EUVD-2026-99911

Exploitation requires network reach to the Windows Error Reporting component on an unpatched host; per the CVSS vector (AV:N/PR:N/UI:N) no authentication and no user interaction are needed against affected builds. The practical limiting factor is reachability of the WER/reporting interface: WER is traditionally a local telemetry subsystem, so successful remote exploitation likely depends on a network-exposed error-reporting path or service, which may not be present in default or firewalled deployments - defenders should confirm with Microsoft's MSRC advisory whether a specific listening interface or configuration is required. Affected versions span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025; hosts patched to the fixed builds listed in EUVD are not exploitable.

Multiple signals point to genuine high priority, but with one notable caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity path to full compromise (C:H/I:H/A:H, base 9.8), and CISA's SSVC framework reinforces the severity with Automatable:yes and Technical Impact:total - meaning the flaw is scriptable into reliable, repeatable exploitation with total control of the target. However, exploitation-pressure signals are currently LOW and should be stated plainly: SSVC Exploitation is 'none', the CVE is NOT listed in CISA KEV, and no public POC was provided in the input, so this is 'no public exploit identified at time of analysis'. EPSS was not supplied and cannot be factored in. A second point to verify: Windows Error Reporting (WER) is historically a local/user-mode telemetry component, so a purely network attack vector is atypical for this subsystem - the AV:N rating and 'over a network' phrasing should be confirmed against Microsoft's MSRC advisory, as real-world reachability may depend on a network-exposed WER/reporting interface rather than arbitrary remote access. Net assessment: patch urgently given the ubiquity of Windows and the Automatable:yes signal, but the absence of observed exploitation means this is not yet an emergency on the level of an actively-exploited KEV entry.

A remote attacker sends specially crafted data to a network-reachable Windows Error Reporting interface, triggering a heap-based buffer overflow (CWE-122) that corrupts memory and allows arbitrary code execution in the context of the vulnerable service. Because CVSS indicates no authentication or user interaction (PR:N/UI:N) and SSVC rates the attack Automatable:yes, a reliable exploit could be scripted and run at scale. No public exploit code was identified at the time of analysis.