Windows Event Log EUVD-2026-99796

Exploitation requires the attacker to already have authenticated local access to the target host (CVSS PR:L, AV:L) - there is no remote or unauthenticated path. The vulnerable component is the Windows Event Logging Service, which is present and running by default on all supported Windows client and server editions, so no special non-default feature or configuration must be enabled to reach the vulnerable code. The primary limiting factors are the need for prior local authenticated access and the impact being confined to information disclosure (C:H, I:N, A:N) with no code execution or privilege change on its own; no user interaction is required (UI:N).

This is a genuine but low-priority vulnerability, and the available signals are mutually consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a locally-exploitable information disclosure requiring low privileges and no user interaction, with high confidentiality impact but no integrity or availability impact - meaning an already-authenticated local user could read memory they should not. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-scripted at scale), and Technical Impact=partial. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis. The local attack vector (AV:L) is the dominant risk-limiting factor: an attacker must already have authenticated access to the host, which removes remote and unauthenticated mass-exploitation from the threat model. There is no conflict between the CVSS vector and the description - both agree the flaw is local and information-disclosure only. Net assessment: a real, patchable issue worth routine remediation but not an emergency, consistent with a high-CVSS-component (C:H) but modest overall real-world risk.

An authenticated local user (or malware already running under a low-privileged account) invokes the Windows Event Logging Service in a way that triggers a buffer over-read, causing the service to return adjacent process memory contents. The leaked memory could contain sensitive data such as credentials, tokens, or address-layout information useful for chaining into further privilege escalation. No public exploit code has been identified at time of analysis, and the local attack vector means the attacker must already have a foothold on the system.