CVE-2026-97798 — Escalation in Windows Error Reporting

CVE-2026-97798 describes an improper neutralization of argument delimiters (argument injection) in Windows Error Reporting. An authorized attacker can exploit this flaw to elevate privileges from ordinary user to SYSTEM locally. The vulnerability lies in how WER (Windows Error Reporting) processes command-line parameters, failing to properly neutralize the delimiters that separate arguments, allowing injection of additional commands.

The flaw receives a CVSS score of 7.8, classified as high. The current status is critical: the CVE was published on October 13, 2026, and by October 29, a proof-of-concept is already publicly available on GitHub demonstrating the exploit on Windows 11. The PoC specifically uses an adaptive resolver for faultrep.dll, highlighting the precise attack vector.

For system administrators and CISOs, immediate actions include: verify the availability of official patches for Windows Error Reporting from the vendor; inventory all Windows 11 and earlier versions exposing this service; implement the principle of least privilege to limit which users can interact with WER; monitor wer.exe and faultrep.dll processes for anomalous behavior or unauthorized command execution; apply patches as soon as they become available.