A heap-based buffer overflow in Windows Error Reporting can be triggered by an authorized attacker to elevate privileges, allowing the attacker to gain higher access rights and potentially compromise sensitive data and system integrity. The weakness is identified as CWE-122, indicating unbounded memory writes in heap allocation, which directly enables the privilege escalation. No additional impact beyond elevated privileges is described in the given information.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and Server Core installations. These systems span 32‑bit and 64‑bit variants across the mentioned releases.

The CVSS score of 8.0 classifies this flaw as high severity. An EPSS score is not available; however, the likely attack vector is over a network from an authorized user who can trigger the overflow. The vulnerability is not listed in the CISA KEV catalog, but its impact on privilege escalation makes it a significant risk for environments where the Error Reporting service is exposed.