Windows Event Logging EUVD-2026-56321

Exploitation requires an authenticated local session with at least standard user (low) privileges on the target Windows host - the CVSS PR:L metric confirms this. The attacker must be able to invoke the Windows Event Logging Service API, which is available to all locally authenticated users by default. No special configuration, non-default settings, or elevated permissions beyond a standard local login are required. Exploitation is limited to the local system (AV:L, S:U), meaning remote unauthenticated exploitation is not possible. The impact is strictly read-only information disclosure (C:H/I:N/A:N); arbitrary code execution is not achievable through this flaw alone.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.5 Medium) accurately characterises this as a local, low-privilege, zero-interaction information-disclosure flaw. The High confidentiality impact is the primary concern: a successful read can expose arbitrary memory contents from the Event Logging Service process. Attack complexity is Low once local access is obtained, but the AV:L and PR:L constraints meaningfully bound realistic risk - an attacker must already have an authenticated foothold on the machine, reducing the value of this vulnerability as an initial access mechanism; it is more useful as part of a post-exploitation chain. No EPSS data was provided in the input; the absence of KEV listing and POC availability keeps exploitation probability low by observable signals. The vendor tags list 'Buffer Overflow', which is technically imprecise - CWE-126 is a read-only over-read, not a write overflow - defenders should not expect code-execution risk from this specific flaw. The broad version range (19 affected CPE entries across a decade of Windows releases) elevates patch-deployment scope, but the confidentiality-only impact limits the blast radius of any single exploitation event.

An attacker who has gained a low-privilege local session - via phishing, stolen credentials, or a prior initial-access exploit - runs a crafted application that invokes the Windows Event Logging Service API with a malformed request, triggering the buffer over-read. The service returns memory contents from beyond the intended buffer boundary, potentially including in-process data such as other users' log data, session tokens, or fragments of privileged memory. No public exploit code has been identified at time of analysis, so exploitation currently requires custom tooling.