Windows Error Reporting: Heap-based buffer overflow allows remote code execution

Summary

Microsoft's Windows Error Reporting component contains a heap-based buffer overflow (CWE-122) that Microsoft classifies as remote code execution. According to the NVD record, an unauthorized attacker can execute code over the network without privileges or user interaction, with high impact on confidentiality, integrity and availability. The CNA record lists several Windows 10, Windows 11 and Windows Server versions, including Windows 10 Version 1607, but the sources do not describe the reachable network attack path. The CVSS base score is 9.8 (critical).

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)
• Note: the NVD CPE data names a different product set than the CNA record. Verify the list on the MSRC page.

Fixed in

• Per the CNA record, the fixed builds are the builds at or above the listed upper bounds, for example 10.0.14393.9612 for Windows 10 1607 and Server 2016.
• Microsoft released a security update for Windows 10 Version 1607 (32-bit) on October 13, 2026. KB number: Unknown. Take the KB number and build from the MSRC product table.

Workaround

Unknown. No Microsoft or third-party mitigation guidance was found in the sources reviewed.

Exploitation

• Not listed in CISA KEV (per OpenCVE).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• EPSS is about 0.011 (roughly 1%).
• No public proof of concept was found in a limited search. This is an absence of evidence, not proof that none exists.

Our recommendation

• Confirm the affected and fixed builds for each product on the MSRC page.
• Inventory all listed Windows systems, especially Windows 10 1607 and Windows Server 2012, 2012 R2 and 2016, and check whether they are still in service.
• Install the October 2026 security update where a fix exists, and plan replacement for unsupported systems.
• Isolate any system that cannot be patched from untrusted networks.
• Check the MSRC FAQ for the attack path and interim mitigations, and monitor KEV and vendor advisories for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83519 msrc.microsoft.com
• OpenCVE: CVE-2026-83519 app.opencve.io
• Vulners: NVD:CVE-2026-83519 vulners.com
• Zero Day Initiative: The October 2026 Security Update Review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:41.