Windows Error Reporting EUVD-2026-99975

Exploitation requires the attacker to already have local, authenticated access to the affected Windows system at low privilege (CVSS PR:L, AV:L) and the ability to invoke or interact with the Windows Error Reporting component so the vulnerable out-of-bounds read code path is reached. No user interaction by a victim is needed (UI:N). Limiting factors: there is no remote vector, valid local credentials or an existing code-execution foothold are prerequisites, and the impact is confined to information disclosure (C:H, I:N, A:N) - the bug cannot by itself alter data or crash the system, and affected builds are only those below the patched versions listed in the EUVD advisory (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a genuinely moderate, low-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-privilege, no-interaction information disclosure with high confidentiality impact but no integrity or availability effect. All secondary signals agree and reinforce the low-urgency reading: CISA's SSVC framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, which maps to a 'Track' rather than 'Act' disposition. There is no CISA KEV listing and no public exploit identified in the provided data, so this is not an actively exploited bug. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this data. The signals are consistent with one another - a high-CVSS confidentiality label driven by C:H, but gated behind local access and existing low-privilege authentication (PR:L), making it a memory-disclosure primitive rather than a standalone high-risk flaw. Realistically useful mainly as an information-leak component (e.g., defeating ASLR or harvesting memory contents) chained with a separate privilege-escalation or code-execution bug.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) triggers the Windows Error Reporting component to perform an out-of-bounds read, leaking adjacent process or kernel memory. The disclosed memory could contain sensitive data or pointers useful for bypassing mitigations like ASLR. No public exploit code is identified at time of analysis, and local access plus valid credentials are required, so this is not remotely exploitable.