Windows Error Reporting EUVD-2026-99952

Requires the attacker to already have local, authenticated access with low privileges on the Windows host (AV:L, PR:L) - there is no remote or unauthenticated path. Exploitation targets the Windows Error Reporting (WER) component via a use-after-free (CWE-416). The key limiting factor is high attack complexity (AC:H): a use-after-free elevation typically demands winning a race condition or precise heap grooming to reclaim the freed allocation, so exploitation is not reliable on a single attempt and is not automatable per SSVC. No user interaction is required (UI:N). Affected are specific unpatched build ranges across Windows 10/11 (including 23H2-26H2) and Windows Server 2012 through 2025; patched builds listed in the EUVD data are not vulnerable.

Signals are mixed and point to a genuine but non-urgent patching priority. The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U - meaning exploitation requires local access, an already-authenticated low-privileged account, AND a high-complexity precondition (AC:H), which for a CWE-416 use-after-free typically reflects winning a race or grooming the heap into a specific state. CISA SSVC reinforces the lower urgency: Exploitation=none (no observed exploitation) and Automatable=no, which is consistent with the AC:H rating, even though Technical Impact=total aligns with the C:H/I:H/A:H full-SYSTEM compromise outcome. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. KEV status is not listed (not in CISA KEV) and no POC is indicated, so there is no public exploit identified at time of analysis. Net: this is a credible local privilege-escalation primitive that attackers value as a second-stage tool after initial foothold, but the local-only vector, authentication requirement, and high attack complexity make it a routine-priority patch rather than an emergency. Note one data tension to verify: the input Tags include 'Denial Of Service', yet the description and CVSS (C:H/I:H/A:H, elevation of privilege) describe a code-execution/EoP outcome, not a pure DoS - treat the DoS label with caution.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) runs a crafted local program that manipulates Windows Error Reporting to trigger a use-after-free, then reclaims the freed memory to redirect execution and escalate to SYSTEM. Because CVSS specifies AC:H, the exploit must reliably win a timing/heap-grooming race, so success is not guaranteed on every attempt. No public exploit code is identified at time of analysis.