Windows Event Log EUVD-2026-100015

Exploitation requires attacker-influenced data to reach the Windows Event Logging Service and requires user interaction (UI:R) plus a hard-to-meet runtime/memory condition (AC:H) to trigger the out-of-bounds read in CWE-125; it is unauthenticated (PR:N) and network-reachable (AV:N) against affected builds. Limiting factors that reduce realistic risk: mandatory user interaction, the high-complexity precondition (specific timing or memory layout rather than a deterministic single request), and that only unpatched builds are affected - Windows 11 23H2 (<10.0.22631.7652), 24H2/25H2 (<10.0.26100.9711 / <10.0.26200.9711), 26H1 (<10.0.28000.3231), 26H2 (<10.0.26300.9711), Windows Server 2022 (<10.0.20348.5761) and Server 2025 (<10.0.26100.33650). The input does not name a specific non-default feature toggle; the gating conditions are the complexity and interaction requirements.

Signals conflict and should temper prioritization despite the 7.5 (HIGH) score. The CVSS vector is network-reachable and unauthenticated (AV:N/PR:N) with total impact (C:H/I:H/A:H), but it is gated by high attack complexity (AC:H) and required user interaction (UI:R), which materially lowers real-world exploitability. CISA's SSVC framework reinforces a lower-urgency posture: Exploitation=none, Automatable=no, Technical Impact=total - i.e., severe if achieved but not currently exploited and not mass-scannable/wormable. There is no KEV listing and no identified public exploit code, and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. Note a classification tension: CWE-125 (out-of-bounds READ) and the 'Information Disclosure' tag imply a memory-disclosure primitive, yet both the description and the C:H/I:H/A:H impact assert 'execute code over a network' - an OOB read alone rarely yields direct RCE, so the code-execution claim likely depends on chaining or memory-layout conditions; verify the exploitation mechanism with Microsoft (MSRC). Overall: a patch-soon, not drop-everything, item - genuine total-impact potential but blunted by AC:H + UI:R and no current exploitation evidence.

A remote attacker lures a user into an action that causes the Windows Event Logging Service to parse attacker-influenced event data, triggering an out-of-bounds read that is leveraged toward code execution. Because the CVSS vector specifies high complexity (AC:H) and user interaction (UI:R), the attacker must win specific timing/memory conditions and rely on victim participation, making opportunistic mass exploitation unlikely. No public exploit code has been identified at time of analysis.