Privilege escalation exploit for Windows Error Reporting goes public
Windows Error Reporting has a command injection flaw caused by improper handling of argument delimiters, disclosed on social media by the DarkWebInformer account. An attacker who already has authorized local access can elevate privileges on the affected system, and an exploit has been published. The sources cite no fix or affected versions; restrict local access and track Microsoft updates.
What happened
A flaw in Windows Error Reporting lets an attacker who already has authorized local access run commands and elevate their privileges on the system. An exploit was published publicly on social media.
Why it matters
The flaw requires the attacker to already have authorized local access to the machine, so the main risk is insider scenarios or already compromised computers. If exploited, it grants the attacker administrative control of the system.
What to do
Restrict local user accounts and granted administrative privileges, monitor for suspicious process creation, and track Microsoft advisories to apply the fix when available.
For the technical team
- CVE
- CVE-2026-97798
- Affected
- Microsoft Windows Error Reporting (componente do Windows) · Windows Error Reporting (Windows component). Specific versions not cited in the source.
- Exploitation
- Exploit publicly released, with link posted by the DarkWebInformer account on X. No reports of exploitation in real attacks in the sources.
- Fix
- Not cited in the sources.
- Vector
- Componentent: Windows Error Reporting. Flaw: command injection due to improper handling of argument delimiters. Condition: requires an authorized attacker with local access to the system.
- More details
- CVE-2026-97798. Initial disclosure by the DarkWebInformer account on social media, with an exploit link. The sources cite no dates, affected versions, fix, or discoverer.
Timeline
First disclosure: CVE-2026-97798 with exploit posted on social media.
Sources 1 source
- @DarkWebInformer @DarkWebInformer
