The Vulnerability is a time‑of‑check to time‑of‑use race condition in the Windows Error Reporting system that allows an attacker with local authorization to elevate privileges. This flaw stems from unsynchronized access to shared data and results in the attacker gaining higher privileges on the affected system. The weakness aligns with CWE‑122 for unchecked memory read/write issues and CWE‑367 for race conditions.

Affected versions include Microsoft Windows 10 from version 1607 through 22H2 and Windows 11 from versions 23H2 through 26H2, as well as Windows Server editions from Server 2012 to Server 2025, including both full and server‑core installations.

The CVSS score of 7 indicates a high severity, and the EPSS score is not available, which does not provide a clear picture of current exploitation likelihood. Because the flaw requires local authorization, the attack vector is inferred to be local. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild.