Windows Event Logging EUVD-2026-72992

The CVSS vector specifies PR:N (no authentication required) and UI:R (user interaction required), meaning no account privileges on the target are necessary, but some victim-side action must occur. The exact nature of the required user interaction is not specified in the available description or references and must be confirmed against the full Microsoft advisory. The Windows Event Logging Service is enabled and running by default on all affected Windows versions; no non-default configuration is required to expose the affected code path. Exploitation is constrained by the UI:R requirement - fully automated, zero-click mass exploitation is not indicated by the current CVSS vector. All supported Windows releases from Server 2012 onward, and Windows 10/11 across all listed feature versions, are in scope regardless of role or configuration.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-exploitable flaw requiring no authentication but dependent on some form of user interaction, which is the primary constraint moderating risk relative to a fully automated exploit chain. Full C:H/I:H/A:H impact indicates successful exploitation achieves complete system compromise. EPSS data is absent from the available intelligence, limiting probabilistic exploitation forecasting. No CISA KEV listing or public exploit code has been identified at time of analysis, suggesting this is not yet subject to mass exploitation. However, the extraordinary breadth of affected platforms - spanning legacy Windows Server 2012 through current Windows Server 2025 - means that even a mid-sized municipal IT team in opole managing a heterogeneous Windows estate should treat this as high-priority patching, particularly where the Event Log service is accessible over network segments or used for centralized Windows Event Forwarding. The CWE-122 heap overflow class has a proven track record of weaponization once a reliable heap layout is identified.

An unauthenticated remote attacker delivers a specially crafted payload targeting the Windows Event Logging Service, triggering a heap-based buffer overflow in the parsing or processing path. Exploitation requires some victim-side interaction (UI:R), which may involve a user accessing a malicious resource or processing a crafted event source. If the overflow is leveraged to control execution flow, the attacker achieves full code execution on the target system with no prior credentials required.