A heap-based buffer overflow exists in the Windows Error Reporting component that can be triggered by a local attacker who already has authorization on the system. The flaw allows the attacker to write beyond the bounds of a heap buffer, potentially corrupting adjacent memory and enabling arbitrary code execution with the privileges of the compromised process, thereby elevating the attacker’s privilege level.

Microsoft Windows operating systems are impacted, including client releases Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1, as well as server editions Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, both in full and server‑core configurations.

The CVSS score of 7.8 classifies this incident as a high‑severity vulnerability, while the EPSS score is not currently available, suggesting no large‑scale public exploitation has been observed. Since the flaw requires an authorized local user to trigger the buffer overflow, the attack vector is local, and the vulnerability is not listed in CISA’s KEV catalog, indicating lower urgency compared to widespread remote exploits. This elevation of privilege could allow a malicious user to gain administrative rights over the affected machine, leading to system compromise, data theft, or further lateral movement within a network.