PoC Exploit and Technical Details Published for Windows Error Reporting Flaw CVE-2026-97798

TL;DR

Researcher Gaspar Onesto De Luca has released a working proof-of-concept exploit for CVE-2026-97798. This Windows Error Reporting vulnerability carries a CVSS score of 7.8. The PoC turns a standard user account into an interactive SYSTEM shell. Microsoft patched the flaw in its October 13, 2026, security updates.

CVE-2026-97798 is an argument injection bug in the Time Travel Debugging path of Windows Error Reporting (WER). A local attacker can sneak extra options into a privileged TTTracer.exe command line and launch any program as SYSTEM. Full technical details and exploit code are now public, so install the October update now.

Why It Matters

Local privilege escalation bugs are a favorite second step for attackers who already have a foothold. Now the barrier is lower. The public repository includes complete exploit source, a ready-built binary and a video demo.

The researcher validated the PoC from both a standard user and a UAC-filtered administrator account. According to the write-up, it “obtained an interactive SYSTEM command prompt” on Windows 11 24H2.

So far, no exploitation in the wild has been reported. CISA’s assessment in the CVE record lists exploitation as “none.”

How the Attack Works

WER copies a caller-controlled “Process” value into a command line for TTTracer.exe, the Time Travel Debugging recorder. However, it does so “without preserving the field as one argument.” As a result, spaces in the value become argument breaks.

An attacker can then append the recorder’s own -out and -launch options. TTTracer “can start an arbitrary executable with WER’s SYSTEM token.” A blocklist of seven program names does not help, since extra options make the string match none of them.

Interestingly, Microsoft did not fix the quoting itself. Instead, version 10.0.26100.9711 of faultrep.dll “disables the old TTD path at several call sites.”

Affected Versions

• Windows 10 21H2 and 22H2
• Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2022 and Windows Server 2025

Patch and Mitigation

• Install Microsoft’s October 2026 security updates. On Windows 11 24H2, look for faultrep.dll 10.0.26100.9711 or later.
• Watch for TTTracer.exe started by WER with unusual -onlaunch, -out or -launch options.
• Investigate TTTracer children launched from user-writable folders.

The researcher also warns, “Do not remove WER or TTD system files by hand.” Full details of this Windows Error Reporting vulnerability are in the CVE-2026-97798 proof-of-concept exploit repository.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.