COM+ Event System CVE-2026-96933

Exploitation requires the attacker to already possess local, low-privileged authenticated access to the Windows host (CVSS PR:L/AV:L) and to be able to interact with the COM+ Event System Service, which is present and running by default across Windows client and server editions - so no non-default feature toggle is needed, but a pre-existing foothold is mandatory. There is no remote or unauthenticated path: the AV:L vector rules out network delivery, and the lack of a network listener limits exploitation to users or processes already executing on the machine. No user interaction is required (UI:N), and attack complexity is low (AC:L), so the main limiting factor is the prerequisite local access rather than any special configuration.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: an attacker must already have low-privilege authenticated access to the target host (PR:L) and attack it locally (AV:L), with low complexity and no user interaction, yielding full confidentiality, integrity and availability impact once triggered. This is a classic second-stage escalation primitive rather than an initial-access or wormable network bug. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization; the risk is currently theoretical/patch-hygiene driven rather than emergency. Two data-quality signals conflict with the vulnerability class: the 'Information Disclosure' tag contradicts the description ('elevate privileges locally') and the full C/I/A=High impact, so treat this as an Elevation of Privilege issue, not information disclosure. Because the affected component (COM+ Event System Service) ships in every supported Windows client and server edition, the aggregate exposure is very large even though per-host exploitation requires prior local access - making this a high-priority patch in managed fleets but not a drop-everything internet-facing emergency absent exploitation evidence.

An attacker who has already gained low-privilege code execution on a Windows host (e.g., via phishing, a compromised service account, or a prior foothold) invokes the COM+ Event System Service and supplies data that causes it to dereference an untrusted pointer, corrupting memory in a privileged context. By controlling that dereference the attacker executes code as SYSTEM, escalating from a standard user to full host compromise. No public exploit code is identified in the supplied data; exploitation requires local authenticated access (AV:L/PR:L) but is low-complexity with no user interaction.