A researcher has released a working exploit for CVE-2026-97798, a Windows Error Reporting flaw that gives an attacker an interactive SYSTEM shell from a standard user account. Microsoft patched the vulnerability in its October security updates, and no exploitation in the wild has been reported.
Argument Injection Into TTTracer.exe Hands Attackers the SYSTEM Token
Researcher Gaspar Onesto De Luca published the proof-of-concept. The flaw is an argument injection rated CVSS 7.8. Windows Error Reporting copies a caller-controlled Process value into a TTTracer.exe command line without preserving it as a single argument. An attacker can therefore append the -out and -launch options and start any program with Windows Error Reporting’s SYSTEM token.
TTTracer.exe belongs to the Time Travel Debugging path in Windows. The attacker does not need to break into that component directly; the error-reporting service builds the command line on the attacker’s behalf and runs it with its own privileges.
Validated From Standard and UAC-Filtered Administrator Accounts
The researcher validated the technique on Windows 11 24H2, from a standard user account and from a UAC-filtered administrator account. Both produced an interactive SYSTEM shell. The repository accompanying the release includes source code, a compiled binary and a video demonstration.
Local Privilege Escalation as a Second Step
The flaw is a local privilege escalation, so an attacker needs prior access to the machine, for example through a phishing foothold or a low-privilege account. The release lowers the effort needed for the second stage of such an intrusion: once a working binary is public, an attacker no longer needs to reverse-engineer the patch to build one.
Exploitation Status Remains None for Now
CISA’s CVE-record assessment lists exploitation as “none,” and the researcher’s disclosure reports no in-the-wild use. Public exploit code often changes that status over time, though the sources here do not say it has changed.
Patch Timeline and Remaining Exposure
Microsoft released the fix on October 13 as part of its October security updates. The proof-of-concept appeared on November 9, about four weeks later. The guidance attached to the release is to install the October 2026 Windows updates, which carry the fix.
The gap between patch and public exploit is a standard feature of vulnerability disclosure: researchers commonly wait for patches to circulate before publishing code. The delay does not guarantee that all systems are updated. Machines that have not installed the October updates are now exposed to a ready-made exploit, and a four-week lag leaves time for slower enterprise patch cycles to still be in progress.
The disclosure does not identify any threat actors using the technique, and it does not report a version beyond Windows 11 24H2 as validated. Other Windows builds that include the same error-reporting component were not covered in the sources, and the researcher’s testing is the only confirmed scope.
What the Public Release Changes for Windows 11 24H2 Systems
The released package gives attackers a ready tool for the validated platform, Windows 11 24H2, and removes the work of building one. Because the flaw requires local access, its use depends on a prior foothold, such as a phished user session or a low-privilege account on a shared machine.
The researcher’s demonstration from a UAC-filtered administrator account matters because that account type is common on enterprise desktops. Users in it hold administrator rights that are normally restricted by User Account Control, and the exploit still reached SYSTEM from there.
The disclosure describes a clean chain with no memory corruption: the weakness lies in how a command line is assembled. That kind of flaw tends to be dependable once understood, since it does not rely on timing or on a specific memory layout. The CISA assessment of “none” for exploitation reflects the position before the release, and the sources do not report a later change.
