CVE-2026-97798

7.8High

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-88

Impact

Local attackers with standard user credentials can elevate privileges to SYSTEM. They need prior code execution or local shell access on the host to exploit it.

Root cause

Windows Error Reporting fails to properly neutralize argument delimiters in command strings, leading to argument injection.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Install the Microsoft security update for this CVE from Windows Update or the vendor catalog; no interim workaround is provided.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97798PatchVendor Advisory

Source: nvd.nist.gov/vuln/detail/CVE-2026-97798