A double free flaw in Windows Error Reporting enables an authorized attacker with local access to run arbitrary code on the affected machine. The vulnerability arises when the error reporting subsystem incorrectly frees a memory block that has already been released, allowing the attacker to inject custom code and have it executed with the privileges of the process that triggers the error report. This can compromise confidentiality, integrity, and availability of the compromised system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Core installations). All listed editions are vulnerable to the double free bug in the Windows Error Reporting component.

The CVSS score of 7 indicates moderate severity. EPSS is not available, so the exact likelihood of exploitation is unknown, but the vulnerability is not listed in CISA’s KEV catalog. Attack requires local, authorized access, so it is not remotely exploitable under normal circumstances. Nonetheless, any user with sufficient privilege can trigger the flaw and gain code execution on the target system. The underlying weakness, CWE-415, highlights improper use of memory management that can be exploited by a malicious actor exploiting legitimate user privileges.