What happened
CVE-2026-105540 is an incorrect resource transfer between spheres in Windows Error Reporting. An authorised attacker with local access to a host and a low-privileged account can elevate privileges. No action from another user is required. The reported severity is high, with an NVD score of 7.0. The weakness is classified as CWE-669. The attack path requires existing access to the host or device. The facts do not describe a network-based attack path.
Who is affected
The currently verified scope covers affected deployments of Windows 10 versions 1607, 1809, 21H2 and 22H2, and Windows 11 version 23H2 on x64-based and ARM64-based systems. The affected ranges are defined in the vendor-published version information; specific build numbers are not repeated here. Windows Error Reporting is the vulnerable component. Windows Server versions and other Windows 11 versions are not included in the verified scope supplied for this advisory. NVD analysis remains in progress, so the scope may change. Organisations running the listed Windows versions should check the vendor advisory for the applicable fixed versions.
Recommended actions
- Apply the vendor fix for affected deployments. A fix is available; the supplied vendor record identifies a fix for Windows 10 version 1607. Check the vendor advisory for fixed versions applicable to other affected releases.
- Restrict low-privileged account permissions on affected hosts, in line with privilege hygiene, to limit the privileges available to accounts that already have local access.
- Control access to affected devices and hosts, since exploitation requires local access.
- Monitor endpoints for signs of privilege elevation on affected deployments.
