A heap‑based buffer overflow in the Windows Error Reporting component allows an attacker with network access to execute arbitrary code on a target system. The flaw resides in how the service processes incoming error‑reporting data and can be triggered without user interaction. Exploitation grants the attacker full control over the affected machine, resulting in complete compromise of confidentiality, integrity, and availability.

The vulnerability affects a broad range of Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and server‑core installations).

The CVSS base score of 9.8 categorizes this flaw as critical, reflecting the high impact and exploitability. No EPSS data is provided, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Attackers could remotely trigger the overflow by sending specially crafted data to the Windows Error Reporting service over a network connection, suggesting that remote users can exploit the issue without local privileges.