This vulnerability involves improper handling of insufficient permissions or privileges within the Windows Error Reporting component of Windows 10 Version 21H2 (build 10.0.19044.0). An authorized local attacker can exploit this flaw to elevate their privileges on the affected system. The issue is tracked as CWE-280 (Improper Handling of Insufficient Permissions or Privileges). Microsoft has published an official fix to address this vulnerability.

Successful exploitation allows a local attacker with some level of authorization to elevate their privileges, potentially gaining higher system privileges than intended. This can lead to full system compromise, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 21H2 (build 10.0.19044.0) as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20817. Applying this patch will remediate the vulnerability.