Executive brief
Windows Error Reporting is a system component that collects and reports crash data to help Microsoft diagnose problems. A use-after-free vulnerability allows an authorized local user to execute arbitrary code with elevated privileges, potentially enabling complete system compromise or data theft.
Technical details
A use-after-free vulnerability exists in Windows Error Reporting where a freed memory object is accessed under certain conditions, leading to memory corruption. An authenticated local attacker can trigger this vulnerability to achieve privilege escalation from user-level to system-level access. The attack requires local access and prior authentication; remote exploitation is not possible. Patches are available from Microsoft Security Updates.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed