Microsoft Windows Error Reporting: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated attacker on the network to execute code with a CVSS score of 9.8 (critical). No user interaction is required according to the CVSS vector. Windows 10 Version 1607 (Enterprise LTSB 2016) and Windows Server 2016 are affected up to the fixed builds listed below; Windows 10 1607 reached end of support on 13 October 2026.
Affected
- Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
- Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
- Other affected branches per the advisory include Windows 10 1809, 21H2, 22H2, Windows 11 23H2 to 26H2, Windows Server 2012 and 2012 R2, as well as the corresponding builds listed in the Microsoft advisory.
Fixed in
- Windows 10 Version 1607 / Server 2016: 10.0.14393.9612 or later (per third-party mirror, verify at MSRC)
- Windows 10 Version 22H2: 10.0.19045.7807 or later
- Windows Server 2012: 6.2.9200.26434 or later
- Windows Server 2012 R2: 6.3.9600.23470 or later
- KB number for Windows 10 1607: Unknown.
Workaround
No vendor-published workaround known.
- Where patching is not possible, restrict inbound network access to the affected host.
Exploitation
- Not listed in CISA KEV; CISA SSVC exploitation status: none.
- EPSS is below 1 percent.
- Public proof of concept: Unknown, none found in the sources checked.
Our recommendation
- Check whether any Windows 10 1607 or Server 2016 systems are still in use, especially kiosks, POS, thin clients and HMIs.
- Apply the fixed build from the Microsoft Security Update Guide as soon as possible.
- For 1607 devices past end of support, enrol in Extended Security Updates if the fix is needed, or migrate to a supported release.
- Restrict inbound network access to affected hosts and verify that they are not reachable from the internet.
- Monitor for unusual crashes or network activity on affected systems.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Error Reporting
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83748 msrc.microsoft.com
- NVD mirror (Vulners): CVE-2026-83748 vulners.com
- Microsoft advisory mirror (Vulners) vulners.com
- OpenCVE: CVE-2026-83748 app.opencve.io
- Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
- Windows 10 LTSB ending: migration guidance www.insentragroup.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:36.
Original description (NVD)
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.