Low Severity
CVE-2026-97798
Published: Oct 28, 2026
CVE-2026-97798 Windows Error Reporting - Command Injection TO SYSTEM
# CVE-2026-97798 — Windows Error Reporting argument injection to SYSTEM
> [!WARNING]
> This repository is for authorized vulnerability research and controlled lab
> validation. The proof of concept fails closed when it cannot identify exactly
> one compatible `faultrep.dll!SpawnDataCollector` implementation.
CVE-2026-97798 is a local elevation-of-privilege vulnerability in the Windows
Error Reporting (WER) Time Travel Debugging path. An unprivileged caller can
preserve attacker-controlled command-line syntax across the WER privilege
boundary. The elevated collector later concatenates that input into a
`TTTracer.exe` command line without preserving argument boundaries. Injected
`-out` and `-launch` switches are therefore interpreted by the TTD recorder as
recorder options, allowing an attacker-selected executable to be launched with
the collector's elevated token.
The included single-file PoC turns that primitive into an interactive
`NT AUTHORITY\SYSTEM` shell. It has been validated from both a standard user
and a medium-integrity, UAC-filtered administrator account.
[Video](https://www.youtube.com/watch?v=YQiONwB7pVI)
## Repository contents
| Path | Description |
| --- | --- |
| `src/CVE-2026-97798.cpp` | Complete single-image exploit source |
| `bin/CVE-2026-97798.exe` | Reproducible x64 laboratory build |
| `build.ps1` | Deterministic LLVM-MinGW build script |
| `assets/system-shell.png` | Captured `whoami` proof from the isolated VM |
No report PDFs are included yet; the long-form paper is still being edited.
## Root cause
The vulnerable flow crosses several components:
```text
low/medium-integrity process
-> faultrep.dll!CElevatedDataCollection::ControlTimeTravelDebugging
-> faultrep.dll!SpawnDataCollector
-> Windows Error Reporting service (elevated collector)
-> CDataCollection::ControlTimeTravelDebugging
-> TtdControl::LaunchRecordingProcess
-> TTTracer.exe / TTDRecord.dll command-lin