{"id":"CVE-2026-94525","kind":"vulnerability","aliases":["CVE-2026-94525"],"related":[],"title":"Windows Error Reporting: local privilege escalation by running a crafted application","description":"An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\nAn attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.\nThe security update addresses the vulnerability by correcting the way that WER handles and executes files.","summary":"Windows Error Reporting mishandles how it handles and executes files, which lets an attacker who can run a specially crafted application gain higher privileges on the machine. An attacker who succeeds gets greater access to sensitive information and system functions.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["non-windows"],"how_to_check":"- Check the installed Windows build against Microsoft's security update guide for CVE-2026-94525 (unknown: the sources do not give affected build numbers)\n- Confirm Windows Update has installed the latest cumulative update (unknown: the sources do not name it)","fix":null,"status":"open","published_at":"2026-11-10T19:21:38+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T19:49:57+00:00","updated_at":"2026-11-10T20:35:55+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:49:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Error Reporting: local privilege escalation by running a crafted application","impact":"high","summary":"Windows Error Reporting mishandles how it handles and executes files, which lets an attacker who can run a specially crafted application gain higher privileges on the machine. An attacker who succeeds gets greater access to sensitive information and system functions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated privileges and reads sensitive data on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-94525 to get affected Windows builds, the fixed update and any setting; the NVD record gives none of these.","how_to_check":"- Check the installed Windows build against Microsoft's security update guide for CVE-2026-94525 (unknown: the sources do not give affected build numbers)\n- Confirm Windows Update has installed the latest cumulative update (unknown: the sources do not name it)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-windows"],"who_is_affected":"Windows machines where Windows Error Reporting is present, which is the default on Windows. The attacker first needs to run a crafted application on the machine, so the exposure is local to the host. The sources do not state which Windows versions are affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4612,"output_tokens":540,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-94525 to get affected Windows builds, the fixed update and any setting; the NVD record gives none of these.","search":"'-2026':13A,16A '-94525':14A,17A 'access':58B,106C 'address':128C 'allow':85C 'applic':11A,45B,124C 'attack':38B,53B,91C,97C,118C 'correct':132C 'could':84C,103C,119C 'craft':10A,44B,123C 'cve':12A,15A 'elev':66C,86C 'endpoint':18B 'error':2A,26B,73C 'escal':6A,23B 'execut':33B,80C,139C 'exist':70C 'exploit':94C,100C,114C 'file':34B,81C,140C 'function':64B,112C 'gain':46B,104C 'get':56B 'greater':57B,105C 'handl':31B,78C,137C 'higher':47B 'inform':61B,109C 'infrastructur':19B 'let':36B 'local':4A,20B 'machin':51B 'mishandl':28B 'privileg':5A,22B,48B,68C,88C 'privilege-escal':21B 'report':3A,27B,74C 'run':8A,41B,120C 'secur':126C 'sensit':60B,108C 'special':43B,122C 'succeed':55B 'success':93C,99C 'system':63B,111C 'updat':127C 'vulner':69C,83C,102C,116C,130C 'way':134C 'wer':75C,77C,136C 'window':1A,24B,25B,72C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where Windows Error Reporting is present, which is the default on Windows. The attacker first needs to run a crafted application on the machine, so the exposure is local to the host. The sources do not state which Windows versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-94525':14A,17A 'applic':11A 'craft':10A 'cve':12A,15A 'error':2A 'escal':6A 'local':4A 'privileg':5A 'report':3A 'run':8A 'window':1A","search_b":"'access':58B 'applic':45B 'attack':38B,53B 'craft':44B 'endpoint':18B 'error':26B 'escal':23B 'execut':33B 'file':34B 'function':64B 'gain':46B 'get':56B 'greater':57B 'handl':31B 'higher':47B 'inform':61B 'infrastructur':19B 'let':36B 'local':20B 'machin':51B 'mishandl':28B 'privileg':22B,48B 'privilege-escal':21B 'report':27B 'run':41B 'sensit':60B 'special':43B 'succeed':55B 'system':63B 'window':24B,25B","search_c":"'access':106C 'address':128C 'allow':85C 'applic':124C 'attack':91C,97C,118C 'correct':132C 'could':84C,103C,119C 'craft':123C 'elev':66C,86C 'error':73C 'execut':80C,139C 'exist':70C 'exploit':94C,100C,114C 'file':81C,140C 'function':112C 'gain':104C 'greater':105C 'handl':78C,137C 'inform':109C 'privileg':68C,88C 'report':74C 'run':120C 'secur':126C 'sensit':108C 'special':122C 'success':93C,99C 'system':111C 'updat':127C 'vulner':69C,83C,102C,116C,130C 'way':134C 'wer':75C,77C,136C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94525","severity":null,"published_at":"2026-11-10T19:21:38+00:00","modified_at":"2026-11-10T19:21:38+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94525:2678","url":null,"severity":null,"published_at":"2026-11-10T20:35:55+00:00","modified_at":"2026-11-10T20:35:55+00:00","first_seen_at":"2026-11-10T20:35:55+00:00","fetched_at":"2026-11-10T20:35:55+00:00","note":"MSRC update guide page is JS-only (web-cli returns empty; browser-cli quota exhausted); CVRF index only says November 2026 Security Updates (released 2026-11-10). No affected builds or KB read from a primary source, so nothing verified. Revisit when MSRC page is readable."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}