Full Report
Microsoft says the August 2026 security update may trigger 0xc0000409 errors on Windows Server 2016 systems where the Compatibility Appraiser diagnostic service is enabled. [...]
Analysis Summary
# Vulnerability: Windows Server 2016 Compatibility Appraiser Diagnostic Service Crash
## CVE Details
- **CVE ID**: N/A (Functional Regression / Known Issue)
- **CVSS Score**: N/A (Stability issue, not currently classified as a security vulnerability)
- **CWE**: CWE-664 (Improper Control of a Resource Through its Lifetime)
## Affected Systems
- **Products**: Windows Server 2016
- **Versions**: Systems updated with the August 2026 cumulative security update (Originating KBs).
- **Configurations**: Physical devices and Virtual Machines (including VMware and Azure environments) where the **Compatibility Appraiser** diagnostic service is enabled.
## Vulnerability Description
Following the installation of the August 2026 security updates, the Microsoft Compatibility Appraiser—a background task that checks hardware/software readiness for future updates—fails to execute correctly. The `CompatTelRunner.exe` (Compatibility Appraiser Telemetry Runner) process encounters an exception code **0xc0000409** (Stack Buffer Overflow/Security Check Failure), resulting in recurring application crashes and event log spam.
## Exploitation
- **Status**: Not exploited (Functional bug)
- **Complexity**: N/A
- **Attack Vector**: Local (System Task)
## Impact
- **Confidentiality**: None
- **Integrity**: None
- **Availability**: Low (Localized process crash; Microsoft states it does not affect general device functionality or core services).
## Remediation
### Patches
- **Permanent Fix**: Pending. Microsoft is currently developing a resolution to be released in a future update.
- **Current Status**: Users are advised to monitor the Windows Release Health dashboard for the upcoming fix.
### Workarounds
- **Event Log Management**: Microsoft officially states that associated event log warnings (Event ID 1000) can be safely ignored.
- **Service Disablement (Unconfirmed Official Guidance)**: While not explicitly recommended in the brief, disabling the scheduled task for "Microsoft Compatibility Appraiser" in Task Scheduler (`\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser`) typically mitigates `CompatTelRunner.exe` crashes.
## Detection
- **Indicators of Compromise**: N/A (Non-malicious)
- **Detection methods and tools**:
- **Event Viewer**: Check Application Logs for **Event ID 1000**.
- **Exception Code**: Look for code **0xc0000409**.
- **Faulting Application**: `CompatTelRunner.exe`.
## References
- **Microsoft Service Alert**: hxxps[://]admin[.]cloud[.]microsoft/Adminportal/Home?source=applauncher#/windowsreleasehealth/:/issue/WI1467310
- **Vendor Report**: hxxps[://]www[.]bleepingcomputer[.]com/news/microsoft/august-updates-trigger-0xc0000409-errors-on-windows-server-2016/
- **Related Documentation**: hxxps[://]learn[.]microsoft[.]com/windows/win32/memory/address-windowing-extensions