EUVD-2026-99352
GHSA-8j4w-36rm-hqvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Windows Error Reporting over network
-
DeliverySend crafted malformed data
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionCorrupt heap metadata/control data
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach the Windows Error Reporting (WER) service over the network on an affected, unpatched Windows build (per the EUVD list, this spans Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025, including Server Core installs). The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are needed against default configurations, so the primary limiting factors are network reachability of the vulnerable WER code path and whether the host has been updated to the fixed build (e.g., >=10.0.19045.7807 for 22H2, >=10.0.26100.33650 for Server 2025/24H2). The exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. |
| Impact | This is a genuinely high-priority vulnerability on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated code execution with total impact (C:H/I:H/A:H), yielding a 9.8 base score, and CISA SSVC reinforces this with Automatable:yes and Technical Impact:total. However, the exploitation signals temper the urgency: SSVC Exploitation status is 'none', there is no CISA KEV listing, no public exploit code is identified, and no EPSS probability was provided in the input. These signals are consistent rather than conflicting - a severe-but-not-yet-exploited flaw - so the realistic posture is 'patch promptly before weaponization' rather than 'emergency active-exploitation response'. One point warranting verification: Windows Error Reporting (WER) is typically a local/client-side service, yet the description and CVSS both assert a network attack vector with no user interaction; the exact remote trigger path is not detailed in the available data and should be confirmed against the Microsoft MSRC advisory. EPSS is missing, so quantitative exploitation likelihood cannot be stated. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted data that reaches the Windows Error Reporting component, triggering a heap-based buffer overflow (CWE-122) and corrupting heap memory to achieve arbitrary code execution on the target. Because CVSS indicates no privileges and no user interaction are required and SSVC marks the issue Automatable, successful exploitation could be scripted at scale. No public proof-of-concept or exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
RemediationAI
Apply the vendor-released patch from Microsoft by updating to the fixed build for each affected Windows version; for example, Windows Server 2025 requires >=10.0.26100.33650, Windows 11 24H2 requires >=10.0.26100.9711, Windows 10 22H2 requires >=10.0.19044.7807 (per EUVD; verify against the MSRC advisory because the base version is listed as 10.0.19045.0), Windows Server 2019 requires >=10.0.17763.9376, and Windows Server 2012 R2 requires >=6.3.9600.23470. See the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83748 for the complete fixed-build list and deployment guidance. If patching is delayed, assess whether the WER network-facing entry point is reachable in your environment: because the exact entry point is not specified, network-based mitigations (such as restricting inbound access to WER-related services or blocking unnecessary WER network traffic) should be validated against the advisory, and disabling WER may impair crash telemetry and diagnostics. No public exploit code or confirmed active exploitation has been identified, but SSVC marks the issue as automatable with total technical impact, so prioritize patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Windows Error Reporting, a built-in Windows component that collects crash dumps and error reports. Successful exploitation could allow an unauthorized attacker to execute code over a network, as reflected by the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which requires no privileges and no user interaction. CISA's SSVC assessment rates Exploitation as none, Automatable as yes, and Technical Impact as total. The affected code path spans numerous Windows 10 versions (1607, 1809, 21H2, 22H2), Windows 11 versions (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025, including Server Core installations, per EUVD-2026-99352. Note that the precise network exposure of WER is not detailed in the available intelligence and should be confirmed with the Microsoft advisory, since WER is frequently a local-only service.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states an unauthorized attacker executes code over a network (AV:N, PR:N, UI:N), low-complexity heap overflow yielding full code execution, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical flaw in Microsoft Windows Error Reporting - a component present on virtually every supported Windows 10, Windows 11, and Windows Server system - could allow an unauthenticated attacker to run malicious code on affected machines with full system privileges and no user action required. Because the vulnerable component is ubiquitous across the corporate endpoint and server estate, the exposure is organization-wide rather than limited to a single business unit or application. While no public exploit code or active exploitation has been identified at time of analysis, the severity rating and the breadth of affected systems make this a priority patch-and-verify exercise for IT operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB