Heap-based buffer overflow in the Windows Error Reporting component permits an attacker to inject and execute arbitrary code. The flaw can be triggered by sending specially crafted data over a network connection, giving the attacker full control over the target system. Because the vulnerability operates in user mode and requires no privileged credentials, it threatens confidentiality, integrity, and availability of affected machines.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and 23H2; and all Windows Server releases from 2012 (R2 and core) to 2025 (core) contain the vulnerable Error Reporting service.

With a CVSS base score of 9.8 the flaw is classified as critical. The EPSS score is not available, but the high severity, lack of mitigations, and remote network attack vector place the risk at the upper end of the spectrum. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed large-scale exploitation. Attackers can exploit this flaw from a remote machine by communicating with the Error Reporting process and delivering malformed packets, bypassing standard access controls.