EUVD-2026-72993
GHSA-g53w-9qgr-hj23
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable service with no auth needed but requires user interaction to trigger; full C/I/A impact aligns with heap overflow in privileged service.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim user on the target system to perform an action that triggers the vulnerable Event Logging Service code path - most plausibly opening a remote event log connection (e.g., via Windows Event Viewer connecting to a remote or malicious host) or processing a specially crafted log source. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score reflects the most critical metric combination short of a perfect 10: network-accessible, no privileges required, low complexity - offset only by the UI:R requirement that introduces a necessary victim interaction step. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released cumulative update corresponding to your OS build as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69495. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Windows systems within the organization (including clients, servers, and domain controllers) and notify the infrastructure and security teams of the vulnerability's severity and organization-wide impact. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today