Windows Event Log EUVD-2026-99954

Requires the attacker to already have local, authenticated code execution on the target Windows host at low privilege (PR:L) - there is no remote or unauthenticated path (AV:L rules out network delivery, UI:N means no victim interaction is needed once local). The weakness (CWE-908, use of uninitialized resource) is exercised by locally invoking the Windows Event Logging Service, which can expose stale memory contents. Limiting factors: the attacker must first establish a foothold and a valid local session, exploitation is not automatable per SSVC, and impact is confined to information disclosure (I:N/A:N) on the affected build ranges prior to the patched versions listed in the EUVD advisory; patched builds eliminate the condition.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) whose signals are consistent and point to LOW real-world urgency despite the HIGH confidentiality impact. The CVSS vector (AV:L/AC:L/PR:L/UI:N) requires local access and at least low-level authentication, so this is not remotely exploitable and cannot be triggered by an anonymous network attacker. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited/wormed), and Technical Impact=partial. The flaw is NOT in CISA KEV and no POC is referenced in the provided intelligence, so there is no evidence of active or imminent exploitation. The only tension worth noting is between the C:H rating and the SSVC 'partial' technical impact: CVSS treats the leaked data as highly confidential, while SSVC judges the overall control gained as partial - this is a leak of sensitive memory/log contents rather than full compromise. Net: a legitimate patch-management item that fits a normal Patch-Tuesday cycle, not an emergency. It is realistically useful to an attacker only as a secondary step (e.g., post-foothold privilege-escalation reconnaissance), not as an initial-access vector.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, stolen credentials, or a compromised service account) runs a crafted local process that interacts with the Event Logging Service and reads back uninitialized memory contents, disclosing sensitive data such as credentials, tokens, or pointers that were never cleared. No public exploit code is identified at time of analysis, and the attack requires local access plus valid privileges, so it serves as a post-compromise information-gathering step rather than a standalone remote break-in.