An use‑after‑free condition in Windows Error Reporting allows a user with local access to leverage the flaw and gain elevated privileges on the affected system. The weakness is addressed by CWE‑416. The impact is a local privilege escalation, giving the attacker the ability to bypass normal access controls and potentially execute arbitrary code or access protected data.

Affected products include Microsoft Windows 10 1607, 1809, 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both standard and Server Core installations). All listed builds are vulnerable when the Windows Error Reporting component is running.

The CVSS score of 7 indicates a high risk for local privilege escalation. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local authorized user triggering the vulnerable code path, potentially by crafting specific error conditions. An attacker would need local access and the ability to invoke the Windows Error Reporting mechanism to succeed.