Executive brief
Windows Error Reporting, a system component that collects and reports application crash data, contains a heap-based buffer overflow vulnerability. An authorized local attacker could exploit this flaw to execute code with elevated privileges, potentially gaining full system control.
Technical details
A heap-based buffer overflow exists in the Windows Error Reporting component, exploitable by an authenticated local attacker to achieve privilege escalation. The vulnerability requires local access and prior authorization, limiting the attack surface to users already with system access. Successful exploitation grants the attacker elevated privileges on the affected system.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed