Windows Error Reporting: Use-after-free allows local privilege escalation
Summary
A use-after-free vulnerability (CWE-416) in the Windows Error Reporting service allows an authorized local user to elevate privileges to SYSTEM level. Affected are Windows 10 1607, Windows Server 2016 and several other Windows versions. An attacker needs a local account with low privileges and the attack is complex, so it cannot be exploited remotely from the internet. Microsoft rates it as Important with a CVSS score of 7.0.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
- Windows Server 2016 (including Server Core): 10.0.14393.0 to < 10.0.14393.9612
- Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to < 10.0.17763.9376
- Windows 10 Version 21H2 and 22H2: below 10.0.19044.7807 and 10.0.19045.7807
- Windows 11 Version 23H2: below 10.0.22631.7652
- Windows 11 Version 24H2, 25H2 and 26H2: below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
- Windows 11 Version 26H1: below 10.0.28000.3231
- Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to < 6.3.9600.23470
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
- Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later
- Windows 10 21H2 and 22H2: build 10.0.19044.7807 or 10.0.19045.7807 or later
- Windows 11 23H2: build 10.0.22631.7652 or later
- Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 or 10.0.26300.9711 or later
- Windows 11 26H1: build 10.0.28000.3231 or later
- Windows Server 2012 R2: build 6.3.9600.23470 or later
- KB number for Windows 10 1607 and Server 2016: Unknown. See the Security Updates table on the MSRC page.
Workaround
Unknown. Microsoft has published no workaround. Patching is the fix.
Exploitation
- No evidence found that the vulnerability is exploited in the wild. Verify at cisa.gov.
- No public proof-of-concept exploit found.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- EPSS score about 0.27%, which is low.
Our recommendation
- Inventory all Windows 10 1607 and Windows Server 2016 systems.
- Install the fixed build 10.0.14393.9612 or later on supported systems.
- Plan the replacement of unsupported systems, because they will receive no further fixes.
- Restrict local logons to trusted users, remove unneeded local accounts and use application control as additional hardening.
- Prioritise shared, terminal server and multi-user systems.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Error Reporting
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-69387 msrc.microsoft.com
- NVD record via vulners mirror vulners.com
- MS CVE mirror with version ranges vulners.com
- OpenCVE entry app.opencve.io
- EPSS and metadata (Rapid7 via vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:38.
Original description (NVD)
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.