Use of an uninitialized resource in Windows Error Reporting allows an authorized local attacker to elevate privileges. The flaw permits the executing user to gain higher privileges on the affected system, potentially allowing the attacker to gain administrative control or run malicious code with elevated rights.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025. The vulnerability affects both x86 and arm64 architectures as specified by the affected CPEs.

The CVSS score of 7.8 indicates a high severity risk. The EPSS score of 0.00381 (approximately 0.4%) suggests a very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit code. The likely attack vector is local and requires an attacker with legitimate access to the affected machine.