Windows Error Reporting: Heap-based buffer overflow allows local privilege escalation

Summary

Windows Error Reporting in several Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow. An authorized local user can exploit it to gain higher privileges on the system. The attack requires a local account and has high complexity, and the system is not reachable directly from the internet. Successful exploitation could affect confidentiality, integrity and availability on the affected system. No exploitation has been reported, and NVD analysis is still pending.

Affected

• Windows 10 Version 1607 and 1809 (before 10.0.14393.9688 and 10.0.17763.9487)
• Windows 10 Version 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Version ranges as listed in the CVE record; verify against MSRC.

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9688
• Windows 10 1809 / Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2022: 10.0.20348.5870
• Fixed builds are taken from the CNA record and must be confirmed in the MSRC advisory.

Workaround

Unknown. No vendor workaround found; the security update is the fix.

• Restrict local interactive logon on shared and terminal servers.
• Limit local administrator rights.

Exploitation

• No known exploitation in the wild.
• No public exploit code found.
• Microsoft rates exploit code maturity as unproven.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Verify the affected builds and fixes in the MSRC advisory.
• Install the security update on affected systems in the next regular patch cycle, prioritising multi-user PCs, terminal servers and file servers.
• Check that the affected systems are still supported; unsupported builds, such as older LTSB/LTSC editions, will not receive the fix.
• Monitor for unexpected local privilege changes and new local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-96153 www.cve.org
• Microsoft Security Update Guide CVE-2026-96153 msrc.microsoft.com
• OffSeq Radar CVE-2026-96153 (exploitation context) radar.offseq.com
• Strix CVE-2026-96153 (aggregator, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:36.