EUVD-2026-99376
GHSA-4qqj-4fqp-2w79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted ETW file to user
-
DeliveryUser opens malicious payload
-
ExploitTrigger heap buffer overflow in Event Tracing
-
ExecutionCorrupt heap and hijack execution
-
ImpactExecute arbitrary code locally
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local processing of attacker-controlled data by the Windows Event Tracing (ETW) subsystem AND user interaction (UI:R) - a user must open, load, or otherwise process the crafted file/trace payload; the bug is not remotely reachable over the network (AV:L). No special privileges are needed (PR:N), so a standard user triggering the malicious content is sufficient, but the mandatory user-interaction step and local-only vector are the principal limiting factors. The specific ETW feature path and file format that reach the vulnerable heap allocation are not detailed in the available advisory data and should be verified against the Microsoft update guide. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity code-execution flaw that requires no attacker privileges but DOES require user interaction - consistent with a victim opening or processing a crafted file/event-trace payload rather than a remotely-reachable service bug. All exploitation signals point AWAY from mass exploitation: CISA SSVC lists Exploitation=none (no observed or public exploitation) and Automatable=no, meaning it cannot be reliably driven at scale; there is no CISA KEV listing and no public POC in the provided data. The one aggravating factor is SSVC Technical Impact=total, matching the C:H/I:H/A:H full-impact rating - successful exploitation yields complete control of the affected component. No EPSS score was provided, so the quantitative exploitation-probability signal is MISSING and cannot be weighed. Net: a legitimately dangerous full-impact bug if triggered, but the local vector plus mandatory user interaction plus 'Exploitation: none' make it a patch-on-normal-cycle item rather than an emergency, with the caveat that it affects Windows - a ubiquitous platform - so the aggregate patch surface is enormous. |
| Exploit ScenarioDerived | An attacker crafts a malicious file or event-trace log structured to trigger a heap-based buffer overflow in the Windows Event Tracing (ETW) component, then lures a user into opening or processing it (UI:R). When parsed, the overflow corrupts heap memory and allows the attacker's code to run locally in the context of the processing component. No public exploit code is identified at time of analysis, and CISA SSVC currently rates exploitation as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
RemediationAI
Apply the vendor-released patch for your specific build: Windows 10 1607/Server 2016 to 10.0.14393.9612, Windows 10 1809/Server 2019 to 10.0.17763.9376, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2/Server 2025 to 10.0.26100.9711 (client) and 10.0.26100.33650 (server), Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Windows Server 2022 to 10.0.20348.5761, and Windows Server 2012/2012 R2 to 6.2.9200.26434 and 6.3.9600.23470 - noting that the 2012-generation builds are only obtainable through Extended Security Updates enrollment, so unenrolled hosts must be retired or isolated instead. Patch availability and build numbers should be confirmed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83836 before staging, since exploitability is currently assessed as "none" with no public exploit code (SSVC, CISA) and CVE-2026-83836 can therefore follow the normal monthly update cadence rather than an emergency one. Until patched, the highest-value compensating control is to stop untrusted ETW input from reaching the parser: block or restrict user opening of .etl/log/manifest files received from external sources (email gateways and web/Markdown-of-the-Web controls that mark downloads as untrusted), remove the "Event Viewer / trace-viewing" capability from standard users where feasible, and detach trace-collection or log-conversion utilities from privileged contexts - the trade-off is degraded troubleshooting and reduced telemetry ingestion for those workstations. Application allowlisting (AppLocker or Windows Defender Application Control) to limit which executables can parse trace data, plus standard user rights with UAC enforced (the vector is PR:N, so no elevation is needed and privilege reduction does not remove the bug, but it confines the post-exploitation context), narrow the blast radius; removing ETW functionality outright is not recommended because it is a dependency of EDR, Defender, and many management agents. Because the vector is AV:L with UI:R, network-perimeter controls are not an effective mitigation - effort belongs in endpoint patching, file-provenance controls, and user awareness about opening unsolicited trace or diagnostic files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Windows Event Tracing (ETW), the kernel- and user-mode tracing infrastructure that underpins ETW providers, trace sessions, and .etl trace log files, and which is also used by many Microsoft and third-party monitoring, EDR, and diagnostic tools. CWE-122 covers the classic failure mode in which a length or count derived from untrusted input is used to size a heap allocation and is then mismatched with the amount of data actually copied into that buffer, corrupting adjacent heap metadata and allowing a controlled write that can be steered toward code execution. Reaching the vulnerable allocation requires local processing of attacker-controlled data by the ETW subsystem - for example a malformed manifest, trace session definition, or trace file parsed by a component that consumes ETW data - and the assessed vector (AV:L, PR:N, UI:R) confirms the bug is not remotely reachable and grants no special privileges, but does require the user to open, load, or otherwise trigger parsing of the crafted payload. The Microsoft advisory and the EUVD record cover a very broad build matrix (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations), which is typical of a shared tracing component, but the specific ETW feature path and exact file format that reach the vulnerable heap allocation are not disclosed in the available advisory data and should be verified against the Microsoft update guide referenced below.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local code-execution via a crafted payload processed by ETW: AV:L and UI:R because a user must open the content, PR:N since no privileges are needed, full C/I/A impact per CWE-122.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attacker to execute code locally.
Executive ViewAI
A high-severity memory corruption flaw in the Windows Event Tracing (ETW) component affects the entirety of the organization's modern Windows estate, spanning Windows 10, Windows 11, and Windows Server 2012 through 2025. Successful exploitation yields code execution at the logged-in user's privilege level, so an endpoint compromised this way becomes a foothold for credential theft and lateral movement against the same user's data and systems. Because the attack requires a user to open a crafted file and no exploitation has been observed, this is a manageable, patch-driven remediation item rather than a crisis - but the breadth of affected builds makes it a scheduling priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB