Act nowDisclosed

Advisory · CVE-2026-97814

Second heap overflow in Windows Text Shaping in the same update cycle

Windows Text Shaping has a second heap-based buffer overflow this month, also allowing unauthenticated network code execution. Microsoft rates it CVSS 3.1 9.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
Windows Text Shaping
Identifier / CWE
CVE-2026-97814
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

Same component, different crack: text rendering code that can be overflowed twice in one bulletin deserves no benefit of the doubt.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Reach the component

    An unauthenticated attacker sends crafted network traffic to a Windows system running Windows Text Shaping.

  2. 02Memory flaw triggers

    The component mishandles the input and corrupts or reuses memory outside its intended bounds.

  3. 03Code runs

    The attacker gains code execution in the component's context on the target system.

What happened

Microsoft disclosed CVE-2026-97814 in its October 2026 update guide as a distinct heap-based buffer overflow (CWE-122) in Windows Text Shaping, alongside CVE-2026-102210 in the same component.

Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every Windows Text Shaping deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Windows Text Shaping while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for text rendering crashes across applications processing received documents or messages.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Patch once and both Text Shaping flaws close. Document-processing servers are the priority within the fleet.