The flaw is a heap-based buffer overflow in the Windows Error Reporting component that can be triggered by a locally authorized attacker. Exploiting the overflow allows the attacker to execute arbitrary code with elevated privileges, effectively bypassing local security controls and gaining full system access. The weakness maps to CWE‑122 and results in a significant compromise of the confidentiality, integrity, and availability of the affected machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025, including both full and Server Core installations.

The CVSS score of 7.8 highlights a high severity risk, while the EPSS score is not available, indicating insufficient exploitation data. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. The attack vector is presumed to be local, requiring the attacker to have authorized user access to initiate the overflow through the Error Reporting service. Given the local nature, system administrators should treat this as a high‑prioritization patching issue in environments where unauthorized local users could exist.