Windows 10 1607: Heap-based buffer overflow in Windows Error Reporting
Summary
A heap-based buffer overflow in Windows Error Reporting allows an authorized local attacker with low privileges to elevate privileges to SYSTEM. No user interaction is required. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability of the affected system. Microsoft reports no public disclosure, and no active exploitation is known.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9512
- Windows Server 2016 (including Server Core): 10.0.14393.0 to below 10.0.14393.9512
- Other versions listed in the CVE record: Windows 10 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2012 and 2012 R2 (including Server Core)
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9512 or later (per the CVE record ranges; verify the KB on the MSRC page)
- Fixed builds for other versions: see the Microsoft Security Update Guide
Workaround
Unknown.
- Possible interim measure, unverified: limit or disable the Windows Error Reporting service via system policy. Confirm the exact policy with Microsoft documentation before use, as crash reporting will stop.
Exploitation
- Publicly disclosed: No (per Microsoft).
- Exploitation: no evidence of active exploitation; CISA SSVC lists exploitation as none and automatable as no.
- Public proof of concept: none found.
- EPSS: low predicted exploitation probability (around 0.004).
Our recommendation
- Inventory all Windows 10 1607 and Windows Server 2016 systems.
- Confirm the fixed build and KB on the MSRC page and install the update.
- Windows 10 1607 Enterprise LTSB reaches end of support on 13 October 2026; decide on Extended Security Updates or migration for devices that must stay in service.
- Restrict local logon on affected machines and monitor for privilege escalation.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Error Reporting
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5122876, KB5122882, KB5122878, KB5122871, KB5124008, KB5122880
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-69354 msrc.microsoft.com
- Vulners: Microsoft CVE-2026-69354 (MS mirror) vulners.com
- Strix: CVE-2026-69354 www.strix.ai
- OpenCVE: CVE-2026-69354 app.opencve.io
- 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:56.
Original description (NVD)
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.