Windows Error Reporting contains a heap‑based buffer overflow that can be triggered by an authorized user. The flaw permits execution of arbitrary code locally in the context of the Windows Error Reporting service. This attack fundamentally compromises the affected system, as code runs with the privileges of the service component.

The flaw affects multiple Microsoft Windows releases. On Windows 10, the vulnerable builds are 1607, 1809, 21H2, and 22H2. On Windows 11, the vulnerable builds are 23H2, 24H2, 25H2, 26H2, and 26H1. Windows Server versions also contain the flaw: 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and Server Core installations.

The vulnerability carries a CVSS score of 7.8, indicating moderate‑to‑high severity. The EPSS score of <1% suggests a low probability of exploitation. The flaw has not been indexed in the CISA KEV catalog. Attackers must have local, authorized access to the target computer to trigger the overflow, typically by interacting with the Windows Error Reporting service. Once triggered, the attacker can execute arbitrary code in the context of that service, potentially allowing further compromise of the local environment.