CVE-2026-97814: Heap buffer overflow RCE in Windows Text Shaping · ZeroHour

CVE-2026-97814

mass

Heap buffer overflow RCE in Windows Text Shaping

CVSS 3.1

9.8 critical

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 16, 2026

AI analysis

CVE-2026-97814 is a critical heap-based buffer overflow (CWE-122) in Microsoft Windows Text Shaping. An unauthorized attacker can trigger it over the network with no privileges and no user interaction (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Successful exploitation allows remote code execution with high impact to confidentiality, integrity, and availability on the affected system. Windows installations that include this text-shaping component are in scope, but the CVE record does not name specific builds or version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Install the Microsoft security update that addresses CVE-2026-97814 as soon as it is available for your Windows builds, and prioritize systems that accept untrusted network input that can reach text-shaping code. Until patched, reduce exposure of affected hosts to untrusted networks and monitor for unexpected crashes or code execution in processes that handle text shaping. Confirm the fix from Microsoft’s advisory rather than assuming a specific build or KB, because no version range is given in the CVE data.

Affected

Microsoft Windows Text Shaping

—

Estimated exposure

massHundreds of millions to over a billion Windows installations (order-of-magnitude estimate) — Windows Text Shaping is an operating-system text component, so exposure tracks the installed Windows base, which is on the order of hundreds of millions to over a billion devices; no product-specific install or scan count is in the CVE…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

Vendors: microsoft
Products: windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows 11 24h2, windows 11 25h2, windows 11 26h1, windows 11 26h2, windows server 2012, windows server 2016, windows server 2019
Weakness: CWE-122
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-97814

In the news1 stories

Microsoft Patch Tuesday, October 2026 Security Update Review