{"id":"CVE-2026-95977","kind":"vulnerability","aliases":["CVE-2026-95977"],"related":[],"title":"Windows Event Viewer: out-of-bounds read leaks memory to local users","description":"Out-of-bounds read in Windows Event Viewer allows an authorized attacker to disclose information locally.","summary":"Windows Event Viewer reads memory past the end of a buffer, so an authorized local user can see data they should not. The flaw gives information disclosure only, not code execution.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-viewer","infrastructure","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-95977","fix":null,"status":"open","published_at":"2026-11-10T19:21:54+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T20:00:26+00:00","updated_at":"2026-11-10T20:00:26+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:00:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Event Viewer: out-of-bounds read leaks memory to local users","impact":"low","summary":"Windows Event Viewer reads memory past the end of a buffer, so an authorized local user can see data they should not. The flaw gives information disclosure only, not code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","event-viewer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads memory contents they should not see","analyst_note":"Find the affected Windows builds and the patch from Microsoft's security update guide entry for CVE-2026-95977.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-95977\n- unknown beyond that, the sources do not say which Windows builds are affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Any Windows machine where a user already has a local account can read the flawed Event Viewer path. The sources do not name the affected Windows builds, so check the vendor's advisory for the exact versions. Systems without untrusted local users carry less risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4487,"output_tokens":484,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-95977':16A,19A 'allow':65C 'attack':68C 'author':38B,67C 'bound':7A,59C 'buffer':35B 'code':54B 'cve':14A,17A 'data':43B 'disclos':70C 'disclosur':51B 'end':32B 'event':2A,21B,26B,63C 'event-view':20B 'execut':55B 'flaw':48B 'give':49B 'inform':50B,71C 'infrastructur':23B 'leak':9A 'local':12A,39B,72C 'memori':10A,29B 'out-of-bound':4A,56C 'past':30B 'read':8A,28B,60C 'see':42B 'user':13A,40B 'viewer':3A,22B,27B,64C 'window':1A,24B,25B,62C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a user already has a local account can read the flawed Event Viewer path. The sources do not name the affected Windows builds, so check the vendor's advisory for the exact versions. Systems without untrusted local users carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventviewer","infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95977':16A,19A 'bound':7A 'cve':14A,17A 'event':2A 'leak':9A 'local':12A 'memori':10A 'out-of-bound':4A 'read':8A 'user':13A 'viewer':3A 'window':1A","search_b":"'author':38B 'buffer':35B 'code':54B 'data':43B 'disclosur':51B 'end':32B 'event':21B,26B 'event-view':20B 'execut':55B 'flaw':48B 'give':49B 'inform':50B 'infrastructur':23B 'local':39B 'memori':29B 'past':30B 'read':28B 'see':42B 'user':40B 'viewer':22B,27B 'window':24B,25B","search_c":"'allow':65C 'attack':68C 'author':67C 'bound':59C 'disclos':70C 'event':63C 'inform':71C 'local':72C 'out-of-bound':56C 'read':60C 'viewer':64C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95977","severity":null,"published_at":"2026-11-10T19:21:54+00:00","modified_at":"2026-11-10T19:21:54+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}