Microsoft Windows Error Reporting Flaw Rated Critical for Remote Code Execution

A heap-based buffer overflow in the Windows Error Reporting service allows unauthorized attackers to execute code over a network, earning a CVSS 9.8 critical rating.

Threat Times Exposure DeskOctober 14, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek white computer tower sits on a wooden desk with its side panel removed. — AI-generated illustration: Threat Times

Key points

CVE-2026-97815 is a heap-based buffer overflow in Windows Error Reporting that enables remote code execution.
The vulnerability carries a CVSS 9.8 score, classified as critical by the National Vulnerability Database.
Microsoft has published an official advisory for the flaw, which allows unauthorized network-based attacks.

Microsoft has issued an advisory for CVE-2026-97815, a critical remote code execution vulnerability in the Windows Error Reporting service. The flaw allows unauthorized attackers to execute arbitrary code over a network by exploiting a heap-based buffer overflow, according to the Microsoft Security Update Guide.

The National Vulnerability Database assigns the vulnerability a CVSS score of 9.8, rating it as critical. The weakness is categorized under CWE-122, which identifies heap-based buffer overflows as the underlying technical cause. The source material does not specify the ease of exploitation or other factors contributing to the score.

Context and Background

This disclosure follows a series of high-severity Windows vulnerabilities reported earlier this month. As Threat Times reported on October 14, 2026, Microsoft addressed a critical text shaping flaw and a partition driver vulnerability, both rated 9.8 for remote code execution. Those previous issues involved a heap-based buffer overflow in text shaping and an out-of-bounds read in the partition management driver.

The current advisory for Windows Error Reporting adds to the growing list of critical flaws in the Windows operating system. Unlike the previous text shaping and partition driver issues, this vulnerability resides in the error reporting subsystem. However, the technical mechanism of a heap-based buffer overflow remains consistent with the earlier text shaping flaw.

Who Is Affected

The vulnerability affects systems running Windows Error Reporting, a core component of the Windows operating system. According to the Microsoft advisory, an unauthorized attacker can exploit this flaw over a network. This means that remote exploitation is possible without prior authentication on the target system, provided the attacker can reach the vulnerable service.

Organizations relying on Windows for server or workstation infrastructure are potentially exposed. The ability to execute code remotely makes this a high-priority issue for security teams. The source material does not state whether a patch or fix has been confirmed for this vulnerability.

What should you do?

Security professionals should monitor Microsoft channels for the release of a security update addressing CVE-2026-97815. Until a patch is available, organizations should review network access controls to limit exposure of the Windows Error Reporting service. Auditing logs for unusual activity related to error reporting may help detect exploitation attempts.

What to do and how to stay safe: Microsoft

Isolate critical systems from untrusted networks to reduce the attack surface for remote exploitation.
Monitor network traffic for unusual connections to ports associated with Windows Error Reporting services.
Review firewall rules to ensure that error reporting traffic is restricted to necessary internal segments only.
Prepare incident response plans for potential remote code execution scenarios involving heap-based overflows.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.