A heap-based buffer overflow in Windows Error Reporting can allow an attacker to run arbitrary code on a target machine. The flaw resides in the way the Error Reporting service handles certain incoming data, enabling a memory corruption that leads to code execution. As a result, an attacker could gain full control of the affected system, potentially compromising confidentiality, integrity, and availability.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. The issue affects both x86 and x64 architectures as well as ARM64 builds of Windows 11, and applies to Server Core installations as listed in the vendor's advisory.

The CVSS score of 9.8 indicates critical severity. Although an EPSS score is not published, the lack of a KEV listing does not lessen the potential danger; attackers can exploit this remotely without authentication by sending crafted data to the Error Reporting service. Given the high severity and the nature of the vulnerability, the risk to an unpatched system is substantial, making the exploit likely to be pursued if the flaw remains unaddressed.