Executive brief
Windows Error Reporting is a system service in Windows that collects and reports diagnostic data when applications crash. A use-after-free memory vulnerability in this service allows an authorized local user to execute code with elevated privileges, potentially gaining full control of the system. An attacker would need valid system access to exploit this flaw.
Technical details
A use-after-free vulnerability exists in Microsoft Windows Error Reporting (WER), a core Windows system service responsible for collecting crash dumps and diagnostic information. The vulnerability allows a local authenticated attacker to trigger memory reuse by manipulating error reporting mechanisms, leading to arbitrary code execution with elevated SYSTEM privileges. The attack requires local system access and knowledge of the vulnerable code path, but does not require user interaction. No public exploit code is currently known to be in active use, though patches have been made available by Microsoft.
Affected products
- Microsoft Windows Error Reporting
Timeline
- 2026-09-08: disclosed: CVE-2026-69362 published