A privilege escalation vulnerability in Microsoft Windows Error Reporting enables an authenticated attacker to gain elevated system rights, posing a significant risk to local host security.

This vulnerability, classified under CWE-280, involves the improper handling of permissions within the Windows Error Reporting component. An attacker who has already gained low-privileged local access can exploit this flaw to execute code with higher privileges.

Successful exploitation of this vulnerability allows an attacker to transition from a low-privileged user account to a higher privilege level, potentially gaining full control over the local system. Given the CVSS score of 7.8, this represents a high-severity threat that could lead to unauthorized data access, persistence, or the deployment of malicious software within the environment.

Immediate Action: Apply the relevant security updates provided by Microsoft in the January 2026 update cycle to all affected Windows endpoints.

Proactive Monitoring: Monitor system logs for unusual process creation events or unexpected modifications to sensitive system directories initiated by the Windows Error Reporting service.

Compensating Controls: Ensure that the principle of least privilege is enforced across all user accounts to minimize the potential impact if a local account is compromised.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in multiple GitHub repositories.

Due to the potential for local privilege escalation and the availability of public proof-of-concept code, this vulnerability should be prioritized for patching. IT administrators must ensure that all systems running the affected versions of Windows 10 and Windows 11 are updated immediately to prevent local attackers from elevating their access level.