Researcher publishes Windows flaw exploit enabling SYSTEM access

Gaspar Onesto De Luca has published a working proof-of-concept exploit for CVE-2026-97798, a local privilege escalation flaw in Windows Error Reporting (WER) stemming from an argument-injection in the Time Travel Debugging path. The PoC reportedly turns a standard user into an interactive SYSTEM shell, with the researcher stating it was validated from both a standard user and a UAC-filtered administrator account and on Windows 11 24H2. Microsoft addressed the issue in its October 2026 security updates. The flaw is rated CVSS 7.8 (High, v3) and is described as an elevation of privilege vulnerability in the WER service.

The vulnerability arises when WER copies a caller-controlled Process value into a command line for TTTracer.exe without preserving the field as a single argument, allowing spaces to split the value into extra arguments. An attacker can then append TTTracer’s -out and -launch options, enabling TTTracer to start an arbitrary executable with WER’s SYSTEM token.

Microsoft’s faultrep.dll (version 10.0.26100.9711 or later) allegedly disables the old Time Travel Debugging path at several call sites, but the article notes the quoting itself was not fixed. The public exploit repository reportedly includes full exploit source, a ready-built binary and a video demonstration.

Affected products include Windows 10 21H2 and 22H2, Windows 11 releases up to 26H2, and Windows Server 2022 and 2025. Patches are in the October 2026 updates; users should install faultrep.dll 10.0.26100.9711 or later and monitor for TTTracer.exe being started by WER with unusual -onlaunch, -out or -launch options. The article confirms there were no reported exploits in the wild at the time of writing.