The vulnerability is caused by a missing authentication check in a critical Windows Error Reporting function. Because any user who is already logged on can invoke the function, an attacker can manipulate error reports or the way errors are logged. The flaw allows local tampering or modification of diagnostic data, but does not provide remote code execution or broad privilege escalation.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (full and server core installations).

The CVSS score is 7.1, indicating a moderate to high severity. The vulnerability is authenticated and local, so it cannot be accessed remotely; exploitation requires the attacker to be logged in and may need user interaction to trigger the tampering. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, implying no documented large-scale exploitation. The risk remains significant for systems that rely on accurate error reporting, as tampered logs could obscure troubleshooting or hide malicious activity.