Microsoft Windows 10: Heap-based buffer overflow in Windows Error Reporting
Summary
A heap-based buffer overflow in the Windows Error Reporting component of Windows 10 Version 1607 and other listed Windows and Windows Server versions allows code execution. An attacker needs local access with low privileges, for example through a compromised user account. A successful attack would affect the confidentiality, integrity and availability of the system.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
- Windows 10 Version 1809, 21H2, 22H2
- Windows 11 Versions 23H2, 24H2, 25H2, 26H1, 26H2
- Windows Server 2012, 2012 R2 and 2016
All builds per the CNA record; verify on MSRC.
Fixed in
- Windows 10 Version 1607: 10.0.14393.9612 according to the CNA record. A sibling Microsoft advisory (CVE-2026-69354) lists 10.0.14393.9512 for x64 systems. Confirm the fixed build on the MSRC page before setting a target.
- Other listed versions: check the fixed builds on the MSRC page.
Workaround
Unknown. No vendor-published workaround was found. Apply the security update.
Exploitation
- No evidence of in-the-wild exploitation found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS about 0.3% (per mirrored data).
- No public proof of concept found; this does not rule one out.
Our recommendation
- Inventory all Windows 10 Version 1607 systems and Windows Server 2012, 2012 R2 and 2016 systems.
- Install the security update released on October 13, 2026, and verify the build number on the MSRC page.
- Prioritise systems with many users or sensitive data.
- Monitor for unusual local processes and privilege escalation attempts.
- If 1607 is no longer supported, plan a migration (verify the lifecycle on Microsoft's pages).
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Error Reporting
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation unlikely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126835, KB5126836, KB5126868, KB5126651, KB5126657, KB5126655
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83758 msrc.microsoft.com
- CVE record mirror (CVELIST, Vulners) vulners.com
- OpenCVE: CVE-2026-83758 app.opencve.io
- Strix: CVE-2026-83758 www.strix.ai
- Rapid7 mirror (Vulners): CVE-2026-83758 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:07.
Original description (NVD)
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.