Security researcher Gaspar Onesto De Luca has published a working proof-of-concept exploit for CVE-2026-97798, a Windows Error Reporting vulnerability that can turn a standard user account into an interactive SYSTEM shell. The disclosure, published on 9 November 2026, includes complete exploit source code, a ready-built binary and a video demonstration.

CVE-2026-97798 is an argument injection flaw in the Time Travel Debugging path of Windows Error Reporting, known as WER. It carries a CVSS score of 7.8. The researcher validated the exploit from both a standard user account and a UAC-filtered administrator account, and reported that it obtained an interactive SYSTEM command prompt on Windows 11 24H2.

The flaw sits in how WER handles a caller-controlled value. When a program asks WER to record a debugging session, WER copies a value called Process into a command line for TTTracer.exe, the Time Travel Debugging recorder. It does so without keeping that value as a single argument, so spaces inside it become breaks between arguments. An attacker can use that gap to append the recorder's own -out and -launch options, and TTTracer can then start an attacker-chosen program using WER's SYSTEM token.

A blocklist of seven program names does not stop the attack, because the extra options change the command line so it matches none of the blocked names. The vulnerability is classed as argument injection, and it needs no shell command to work: TTTracer itself reads the injected switches.

Microsoft patched the flaw in its security updates of 13 October 2026. The fix does not repair the quoting itself. Instead, the corrected version of faultrep.dll, version 10.0.26100.9711, disables the old Time Travel Debugging path at several call sites so untrusted data never reaches the recorder. The affected systems are Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2022 and Windows Server 2025.

There is no confirmed exploitation in the wild so far, and the assessment in the CVE record lists exploitation as none. The public exploit lowers the barrier for attackers who already have a foothold on a machine, because local privilege escalation is often the second step after an initial intrusion. The 30-day EPSS score for the flaw stands at 0.5 percent.

Anyone running an affected Windows version should install the October 2026 security updates. On Windows 11 24H2, the fixed faultrep.dll is version 10.0.26100.9711 or later. Defenders should watch for TTTracer.exe started by WER with unusual -onlaunch, -out or -launch options, and investigate any TTTracer processes launched from user-writable folders. The researcher warns against removing WER or Time Travel Debugging system files by hand.