Windows Event Logging Service EUVD-2026-99346

Exploitation requires the attacker to already have an authenticated, low-privileged local account and the ability to execute code on the target Windows host (AV:L, PR:L); no user interaction is needed. The specific limiting factor is the mandatory local presence and valid credentials - this cannot be triggered remotely or by an unauthenticated actor. The affected feature is the Windows Event Logging Service, present by default across all listed Windows 10/11 and Windows Server (including Server Core) editions, so no non-default configuration is required to be vulnerable; the practical limiter is simply that the attacker must first obtain local access, and the yield is limited to leaked uninitialized memory (confidentiality only, no integrity or availability effect).

This is a genuinely moderate, low-urgency issue rather than a top-priority emergency, and all available signals agree on that. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a purely local vulnerability: the attacker must already have authenticated code execution on the host (PR:L), and the only impact is confidentiality (C:H) with no integrity or availability loss. CISA's SSVC assessment reinforces this low urgency - Exploitation: none (no observed or proof-of-concept activity), Automatable: no (cannot be reliably scripted at scale because it requires local presence), and Technical Impact: partial. There is no CISA KEV listing and no public exploit code identified, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent: a local-only (AV:L), authenticated (PR:L) information-disclosure bug is not something that lends itself to mass automated attack, which matches SSVC Automatable:no. The main nuance worth stating is that although confidentiality is rated High, this is a local info-leak (uninitialized memory in the Event Logging Service), so realistic impact is exposure of potentially sensitive in-memory data to an already-present low-privileged user - valuable as a secondary step in a chain (e.g., leaking data that aids privilege escalation) rather than a standalone critical breach.

A low-privileged but authenticated local user runs a crafted program or service interaction that triggers the Windows Event Logging Service to return the contents of an uninitialized resource (CWE-908), leaking residual memory that may contain sensitive data from other contexts. Because exploitation is local (AV:L) and requires existing valid credentials (PR:L) with no user interaction, it is most useful as a post-compromise information-gathering or privilege-escalation-support step. No public exploit code has been identified at the time of analysis.