Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability grants the attacker full control of the affected system, compromising confidentiality, integrity and availability. It facilitates remote code execution without requiring user interaction or elevated privileges, making it a critical security risk.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 are impacted.

The CVSS score of 8.8 indicates a high severity. While the EPSS score is not available, the lack of listing in the CISA KEV catalog suggests no confirmed widespread exploitation yet. The likely attack vector is a remote network connection to the Windows Error Reporting service, with no authentication required. An attacker would send crafted data to trigger the stack overflow, leading to code execution on the target system.