EUVD-2026-99933
GHSA-43qw-jp64-5488
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file via phishing
-
DeliveryVictim opens malicious content
-
ExploitOverflow WER stack buffer
-
ExecutionExecute arbitrary code
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target process malicious input through the Windows Error Reporting (WER) component, and per the CVSS UI:R metric it requires user interaction - a victim must open or trigger processing of attacker-supplied content for the overflow to fire. No authentication is required (PR:N), so the attacker needs no prior access or credentials, but the dependence on user action is the key limiting factor and is confirmed by CISA SSVC Automatable: no. Affected scope is broad across Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 at the pre-patch build numbers listed in EUVD; systems updated to the fixed builds are not exploitable. |
| Impact | Signals are mixed but lean toward elevated priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with total CIA impact, consistent with the CWE-121 stack-based buffer overflow enabling remote code execution. However, UI:R means the attack is NOT fully automatic - a user must perform an action (e.g., open a crafted file/report), which is corroborated by CISA SSVC marking Automatable: no. SSVC also lists Exploitation: none, meaning no observed in-the-wild activity, and the CVE is not on CISA KEV. No EPSS score was provided in the input, and no POC is referenced. Technical Impact: total aligns with the C:H/I:H/A:H rating. Net assessment: a genuinely serious RCE in a ubiquitous platform with a vendor patch already available, but the required user interaction and absence of known exploitation or automation lower its immediate real-world urgency compared to a wormable zero-click bug. Patch promptly given the install base, but it is not confirmed as an actively-exploited emergency. Note: EPSS is missing, so widespread-exploitation probability cannot be quantified from the data. |
| Exploit ScenarioDerived | An attacker crafts a malicious file or error-report payload and delivers it to a victim (e.g., via phishing or a malicious download). When the victim opens the content and Windows Error Reporting processes it, the stack-based buffer overflow triggers and executes attacker-controlled code with the victim's privileges. No public exploit code is identified at time of analysis, and user interaction is required, so delivery depends on social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stack-based buffer overflow in Microsoft Windows Error Reporting (WER) allows a remote, unauthenticated attacker to execute code in the context of the affected component, though exploitation requires the victim to open or trigger processing of attacker-supplied content, as reflected by the CVSS UI:R metric. The exposure is unusually broad: Windows 10 and Windows 11 up to 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 at the pre-patch build numbers catalogued by ENISA EUVD, are all listed as affected. CISA's SSVC assessment rates exploitation as none and automatable as no, no public exploit code has been identified at time of analysis, and Microsoft has released vendor patches that fully address the issue on updated builds.
RemediationAI
Install the Microsoft security update for CVE-2026-83643 as documented in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83643); the fix is delivered as cumulative updates that raise affected systems to the patched builds enumerated in the EUVD listing - for example Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, 24H2 to 10.0.26100.9711, 25H2 to 10.0.26200.9711, 26H1 to 10.0.28000.3231 and 26H2 to 10.0.26300.9711, Server 2012 to 6.2.9200.26434, 2012 R2 to 6.3.9600.23470, 2016 to 10.0.14393.9612, 2019 to 10.0.17763.9376, 2022 to 10.0.20348.5761 and 2025 to 10.0.26100.33650. Where patching cannot be completed immediately, the most direct compensating control is to disable the Windows Error Reporting Service and WER's crash-report handling via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Error Reporting), accepting the trade-off that crash diagnostics, dump collection and error telemetry used by enterprise support and reliability workflows are lost, and that some third-party monitoring agents depending on WER will degrade. Restricting outbound network access to Microsoft telemetry/WER endpoints is only a partial mitigation because it blocks report submission while leaving the local parsing path that carries the overflow intact, so it should be treated as containment rather than a fix. Because exploitation depends on a user opening or triggering processing of malicious content, tightening user handling of untrusted attachments and downloads complements but does not replace patching; given CISA SSVC rates exploitation as none and no public exploit code is currently identified, prioritise internet-facing and multi-user Windows 10/11 and Server 2012-2025 estates for the update per standard Microsoft patch cycles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow occurring inside Windows Error Reporting (WER), the crash-reporting and fault-handling subsystem that collects, formats and, where configured, transmits error reports and diagnostic dumps. Because WER ingests attacker-influenceable data while parsing report content, an unchecked length or delimiter assumption causes data to be written past the end of a fixed-size stack buffer, corrupting adjacent stack memory including saved return addresses and enabling control-flow hijack and arbitrary code execution in the WER process context. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H plus the assigned CWE confirm a network-reachable, unauthenticated attack path that nevertheless depends on user interaction - the victim must open or trigger processing of the malicious content - which is why the independent assessment and CISA's SSVC both treat the issue as non-automatable at scale rather than wormable. Scope is unchanged (S:U), and technical impact is rated total, meaning successful exploitation is expected to yield full compromise of confidentiality, integrity and availability for the affected component.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered unauthenticated overflow (AV:N/PR:N) requiring a user to open crafted content (UI:R); memory-corruption RCE yields full C/I/A on the local system (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory corruption flaw in Microsoft Windows Error Reporting (WER) affects virtually the entire supported Windows estate - Windows 10 and 11 through 26H2, plus Windows Server 2012 through 2025 - and could allow an attacker to run code on an endpoint if a user opens crafted content. Because WER is a built-in, always-present Windows component rather than an optional application, the affected footprint spans essentially every managed workstation and server, so unmanaged update cycles directly translate into organizational exposure. Leadership should care less about the individual flaw than about the estate-wide patch burden it creates, though the requirement for user interaction and the absence of known exploitation mean this is a manageability problem today rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB