Public PoC released for Windows Error Reporting privilege escalation CVE-2026-97798 (CVSS 7.8), patched in October 2026
Researcher Gaspar Onesto De Luca has published full technical details, exploit source, a prebuilt binary and a video demo for CVE-2026-97798, an elevation of privilege flaw in Windows Error Reporting (WER) rated CVSS 7.8 (High). The bug is an argument injection in the Time Travel Debugging (TTD) code path: a local attacker can turn a standard user account into an interactive SYSTEM shell. Microsoft addressed it in the October 13, 2026 security updates. No exploitation in the wild has been reported, and the CVE record lists CISA's exploitation assessment as "none". Because exploitation requires prior local access, the realistic risk is as a second-stage step for an attacker who already has a foothold — but the availability of a working, packaged PoC lowers the barrier significantly.
Entenda a falha
A vulnerabilidade
CVE-2026-97798 is an elevation of privilege flaw (CVSS 7.8, High) in Windows Error Reporting (WER), in its Time Travel Debugging (TTD) code path. It is an argument injection: a local attacker with a standard account, or a UAC-filtered administrator, can get an interactive SYSTEM shell. It needs prior local access and no user interaction is mentioned. Affected are Windows 10 21H2, Windows 11 23H2 through 26H2, and Windows Server 2022 and 2025. Microsoft fixed it in the October 13, 2026 updates, with builds such as 10.0.19044.7807, 10.0.19045.7807, 10.0.22631.7652 and 10.0.26100.9711.
Como funciona
WER takes a caller-controlled Process value and uses it to build the command line for TTTracer.exe, the Time Travel Debugging recorder, which runs with WER's SYSTEM token. The value is placed into that command line without being kept as a single argument, so spaces in it are read as argument separators. Extra TTTracer options, including -out and -launch, can therefore be added, and TTTracer then starts an arbitrary executable as SYSTEM. WER has a blocklist of seven program names, but the injected options mean the string matches none of them.
Por que é vulnerável
The root cause is improper handling of untrusted input when building a command line: the Process field is not quoted or kept as one argument, so data becomes command options. The blocklist compares the whole string against seven names, so it is easily bypassed. Microsoft did not fix the quoting itself; faultrep.dll 10.0.26100.9711 instead disables the legacy TTD path at several call sites.
Onde está
The flaw is in the WER component's handling of the TTD path, and the fix is in faultrep.dll (version 10.0.26100.9711 on Windows 11 24H2), which builds the TTTracer.exe command line.
Como foi descoberta
The articles do not say how the flaw was found or reported to Microsoft. Researcher Gaspar Onesto De Luca published full technical details and exploit material after Microsoft patched it in the October 13, 2026 updates. No exploitation in the wild has been reported, and the CVE record lists CISA's exploitation assessment as none.
PoC pública
Gaspar Onesto De Luca published a public repository with full exploit source, a prebuilt binary and a video demo. According to the write-up, it was validated from a standard user and from a UAC-filtered administrator account, giving an interactive SYSTEM command prompt on Windows 11 24H2. It is a working, packaged exploit, so the barrier is low for anyone with local access. No in-the-wild use is reported, but unpatched systems should be updated promptly, since this is a likely second-stage step after an initial foothold.
Publicada em: securityonline.info/windows-error-reporting-cve-2026-97798-poc/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 23:16.
Detalhes técnicos
WER copies a caller-controlled Process value into the command line it builds for TTTracer.exe, the Time Travel Debugging recorder, without preserving the field as a single argument. Spaces in the value therefore become argument separators, letting an attacker append the recorder's own -out and -launch options so that TTTracer starts an arbitrary executable with WER's SYSTEM token. A blocklist of seven program names offers no protection, since the injected options prevent the resulting string from matching any entry. The researcher validated the exploit from both a standard user and a UAC-filtered administrator account, obtaining an interactive SYSTEM command prompt on Windows 11 24H2.
Detalhes da correção
Microsoft did not correct the quoting itself: version 10.0.26100.9711 of faultrep.dll disables the legacy TTD path at several call sites. Fixed builds include 10.0.19044.7807, 10.0.19045.7807, 10.0.22631.7652 and 10.0.26100.9711, among others.
Remediação
Install Microsoft's October 2026 security updates; on Windows 11 24H2 verify faultrep.dll 10.0.26100.9711 or later. Hunt for TTTracer.exe spawned by WER with unusual -onlaunch, -out or -launch options, and investigate TTTracer child processes launched from user-writable folders. The researcher cautions against manually removing WER or TTD system files.
Linha do tempo
-
Public PoC released for Windows Error Reporting privilege escalation CVE-2026-97798 (CVSS 7.8), patched in October 2026
ler a análise desta fonte ocultar
Researcher Gaspar Onesto De Luca has published full technical details, exploit source, a prebuilt binary and a video demo for CVE-2026-97798, an elevation of privilege flaw in Windows Error Reporting (WER) rated CVSS 7.8 (High). The bug is an argument injection in the Time Travel Debugging (TTD) code path: a local attacker can turn a standard user account into an interactive SYSTEM shell. Microsoft addressed it in the October 13, 2026 security updates. No exploitation in the wild has been reported, and the CVE record lists CISA's exploitation assessment as "none". Because exploitation requires prior local access, the realistic risk is as a second-stage step for an attacker who already has a foothold — but the availability of a working, packaged PoC lowers the barrier significantly.
Technical Details
WER copies a caller-controlled Process value into the command line it builds for TTTracer.exe, the Time Travel Debugging recorder, without preserving the field as a single argument. Spaces in the value therefore become argument separators, letting an attacker append the recorder's own -out and -launch options so that TTTracer starts an arbitrary executable with WER's SYSTEM token. A blocklist of seven program names offers no protection, since the injected options prevent the resulting string from matching any entry. The researcher validated the exploit from both a standard user and a UAC-filtered administrator account, obtaining an interactive SYSTEM command prompt on Windows 11 24H2.
Fix Details
Microsoft did not correct the quoting itself: version 10.0.26100.9711 of faultrep.dll disables the legacy TTD path at several call sites. Fixed builds include 10.0.19044.7807, 10.0.19045.7807, 10.0.22631.7652 and 10.0.26100.9711, among others.
Remediation
Install Microsoft's October 2026 security updates; on Windows 11 24H2 verify faultrep.dll 10.0.26100.9711 or later. Hunt for TTTracer.exe spawned by WER with unusual -onlaunch, -out or -launch options, and investigate TTTracer child processes launched from user-writable folders. The researcher cautions against manually removing WER or TTD system files.