This vulnerability is a use‑after‑free flaw in the Windows Error Reporting component. An attacker who has authorized local privileges can trigger the error‑reporting routine to free memory that is still in use, which may allow the attacker to elevate privileges on the system to the level of the SYSTEM account. The description does not state that arbitrary code execution is possible, so this inference is limited to privilege escalation only.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012 R2 through Server 2025, including Server Core installations. All listed operating systems run the Windows Error Reporting service, which contains the vulnerable code.

The CVSS score of 7 indicates a high severity vulnerability. Exploitation requires a local user with authorized privileges, and no network‑based exploitation vector is documented. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. In environments where privileged users are present, the risk is considered significant because the vulnerability provides a pathway to elevate local privileges.