Windows Event Tracing EUVD-2026-100021

Exploitation targets the Windows Event Tracing (ETW) component and requires user interaction (UI:R) - a victim must perform an action such as connecting to or opening attacker-controlled network content that is parsed by ETW; no authentication or prior privileges are needed (PR:N). The limiting factor is this mandatory user interaction, which prevents fully automated/wormable spread (consistent with SSVC Automatable: no). Affected systems are unpatched Windows builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650, Server 2016 <10.0.14393.9612); patched builds are not exploitable.

This is a serious but not maximally urgent vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw with total confidentiality, integrity and availability impact - high raw severity. However, the exploitation signals temper this: there is no CISA KEV listing and no public exploit was provided, so exploitation is 'no public exploit identified at time of analysis.' CISA's SSVC framework reinforces a lower real-world urgency than the CVSS score alone implies - Exploitation is rated 'none' and Automatable 'no' (consistent with the UI:R requirement, which breaks fully automated/wormable mass exploitation), even though Technical Impact is 'total.' The key tension to flag: the 8.8 score and PR:N make this look like a drive-by RCE, but UI:R means a victim must perform an action, and SSVC 'Automatable: no' indicates it cannot be reliably scaled without that interaction. EPSS was not provided in the input, so probabilistic exploitation likelihood could not be factored in - treat the SSVC 'none' as the primary exploitation signal. Net: prioritize patching because the affected product is ubiquitous and a vendor patch exists, but this is interaction-gated rather than an unauthenticated zero-click worm.

An attacker lures a user into connecting to or processing malicious network content that is handled by the Windows Event Tracing component, triggering a heap-based buffer overflow (CWE-122). Because the required user interaction (UI:R) gates the attack, delivery typically relies on social engineering such as a crafted link, file, or service connection; no authentication is required (PR:N). No public proof-of-concept was identified in the provided data.