Windows Event Logging EUVD-2026-72993

Exploitation requires a victim user on the target system to perform an action that triggers the vulnerable Event Logging Service code path - most plausibly opening a remote event log connection (e.g., via Windows Event Viewer connecting to a remote or malicious host) or processing a specially crafted log source. The attacker requires no credentials on the target system (PR:N). Limiting factors: the UI:R requirement prevents fully automated, zero-interaction exploitation; the attacker must either control a malicious event source the victim connects to or otherwise socially engineer the user interaction. Scope is limited to the target system (S:U), so lateral movement requires a separate post-exploitation step. Windows Server 2012/2012 R2 are included in the affected range despite being past standard support, indicating this is an unusually broad patch batch.

The CVSS 8.8 score reflects the most critical metric combination short of a perfect 10: network-accessible, no privileges required, low complexity - offset only by the UI:R requirement that introduces a necessary victim interaction step. EPSS data is not provided in the input, so exploitation probability cannot be quantified from that signal. No CISA KEV listing is present, and no POC is referenced, meaning there is no confirmed in-the-wild or public exploitation at time of analysis. That said, the real-world risk is elevated by several factors: the Windows Event Logging Service is universally present on every affected build, patch coverage must span an unusually wide OS version matrix (Server 2012 to Server 2025, Windows 10 to 11 26H1), and heap overflow primitives in privileged Windows services have historically been weaponized within weeks of disclosure. The UI:R constraint is a meaningful real-world mitigator - exploitation likely requires a user to connect to a remote system's event log or open a crafted log source, which limits opportunistic mass-scanning attack scenarios but not targeted or social-engineering-assisted attacks. The S:U (no scope change) limits blast radius to the service process itself, but given the service's likely privilege level, post-exploitation pivot is trivial.

A remote attacker identifies a target Windows system with Event Viewer remote access enabled, then social-engineers or otherwise induces an authenticated user on the target to open a connection to a malicious or compromised event log source. The crafted event log data triggers the heap-based buffer overflow in the Event Logging Service, allowing the attacker to overwrite heap structures and redirect code execution to attacker-supplied shellcode running at the service's privilege level. No public POC exists at time of analysis, but the AV:N/AC:L CVSS vector suggests limited technical barriers once the user interaction condition is met.