Windows Error Reporting EUVD-2026-99976

Exploitation requires the attacker to already hold a local, low-privileged authenticated session on the Windows host (PR:L, AV:L) and to successfully win a time-of-check-time-of-use race condition within Windows Error Reporting - a non-deterministic timing window that typically demands repeated attempts, which is precisely what drives the High attack complexity (AC:H) and CISA's SSVC Automatable='no' rating. No user interaction by a victim is needed (UI:N), and default configurations are affected since Windows Error Reporting is a built-in OS service. The key limiting factors for defenders: remote-only attackers cannot trigger this directly (no network vector), unprivileged code execution on the host is a prerequisite, and the race-window reliability sharply reduces the odds of consistent, automated exploitation.

This is a genuine but second-tier priority - a serious local privilege escalation that is NOT currently an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a consistent story: the attacker must already have local, authenticated low-privilege access (PR:L, AV:L), and successful exploitation requires winning a time-of-check-time-of-use race condition, which is why complexity is High (AC:H). The signals converge rather than conflict: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', which aligns with the AC:H race-window requirement - this is not a point-and-click, mass-exploitable bug. It is NOT on the CISA KEV list and no public exploit was provided in the input, so there is no public exploit identified at time of analysis. The one signal pulling the other way is SSVC Technical Impact: 'total', matching the full C:H/I:H/A:H triad (SYSTEM-level compromise if the race is won). No EPSS score was provided, so statistical exploitation probability cannot be weighed. Net: treat as a standard-cadence patch item, not a drop-everything issue - the high impact is real, but the local-only vector, required prior access, and race-condition complexity make widespread or automated exploitation unlikely in the near term.

A low-privileged local user (or malware already running under a standard user account) repeatedly triggers a Windows Error Reporting operation while racing a file/resource check against its subsequent use, aiming to win the narrow TOCTOU timing window. On a successful race, the WER component performs a privileged action on attacker-substituted input, yielding code execution at SYSTEM. No public proof-of-concept was provided, and the High attack complexity means exploitation typically requires many attempts to hit the race window.