Microsoft Windows: Local privilege escalation via race condition in Error Reporting

Summary

A time-of-check time-of-use race condition in Windows Error Reporting allows a local attacker with existing access to elevate privileges. The attacker must already have a logon on the affected system and must win a timing race. The CVSS 3.1 base score is 7.0 (High), and no public exploit code or active exploitation is known.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Note: the CPE in the input lists only Windows 10 1607. The CVE record lists the products above.

Fixed in

• Install the October 2026 security update for each affected version.
• First fixed builds according to the CVE record: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Confirm the exact builds on the Microsoft Security Update Guide before deployment.

Workaround

Unknown. Microsoft does not describe a workaround in the retrieved information. Patching is the fix. A third-party site suggests disabling the Windows Error Reporting service, but this is not confirmed by Microsoft and may affect troubleshooting.

Exploitation

• Publicly disclosed: No (according to the Microsoft Security Update Guide).
• Exploited in the wild: No reports found. CISA SSVC: exploitation none, automatable no.
• EPSS score: 0.00233 (very low).

Our recommendation

• Install the October 2026 security update on all affected systems, prioritising shared workstations, terminal and RDP servers, and servers with many user logons.
• Check whether Windows 10 1607 and Windows Server 2012 systems are still supported by Microsoft. If not, plan an upgrade or isolate them.
• Reduce local administrator rights and remove unneeded local accounts to limit the impact of a local escalation.
• Monitor for unusual privilege changes and unexpected SYSTEM processes on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83750 msrc.microsoft.com
• Vulners: CVELIST CVE-2026-83750 vulners.com
• Vulners: NVD CVE-2026-83750 (EPSS) vulners.com
• OpenCVE: CVE-2026-83750 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:18.