Executive brief
The Windows Event Logging Service, a core component responsible for logging system events and activities, contains a heap-based buffer overflow vulnerability. An attacker can exploit this flaw over the network to execute arbitrary code with system-level privileges, potentially compromising the entire Windows system and allowing unauthorized access to sensitive data.
Technical details
The vulnerability is a heap-based buffer overflow in the Windows Event Logging Service that can be triggered remotely without authentication. The flaw allows an attacker to overflow a heap buffer by sending specially crafted network requests to the Event Logging Service, leading to memory corruption. Successful exploitation enables remote code execution (RCE) with the privileges of the Event Logging Service process. Microsoft has released security patches to address this vulnerability.
Affected products
- Microsoft Windows Event Logging Service <UNKNOWN>
Timeline
- 2026-09-08: disclosed