{"id":"CVE-2026-95997","kind":"vulnerability","aliases":["CVE-2026-95997"],"related":[],"title":"Windows: Event Logging Service use-after-free lets local users gain privileges","description":"Use after free in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 update fixes a use-after-free in the Windows Event Logging Service (CWE-416). An authorized local attacker can gain SYSTEM privileges. Microsoft rates it Important (CVSS 7.8), says it is not publicly disclosed or exploited, and assesses exploitation as less likely. Affected and fixed build numbers were not read. Windows systems without the November 2026 update are exposed; the attacker needs local low-privilege access, so shared machines, terminal servers and developer or CI Windows hosts matter most.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","self-hosted","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Run winver, then compare your build against the fixed build listed for CVE-2026-95997 in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997). Installing the November 2026 cumulative update for your Windows version is the vendor's required customer action.","fix":null,"status":"open","published_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:36:55+00:00","updated_at":"2026-11-10T20:13:24+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:36:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Event Logging Service use-after-free lets local users gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Event Logging Service lets an authorized local attacker elevate their privileges. The sources give a CVSS score of 7.8 and say nothing about a public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the Windows host","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-95997 to get affected and fixed Windows builds and whether exploitation is seen.","how_to_check":"- Check the Windows build with `winver` and compare it to the fixed build in Microsoft's advisory for CVE-2026-95997\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines with the Event Logging Service running are the systems to look at, and the attacker needs a local account first. The sources do not say which Windows builds are affected or which are fixed. Machines that only run as single-user devices with no other local accounts carry less practical risk, but the sources do not establish that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4482,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-95997 to get affected and fixed Windows builds and whether exploitation is seen.","search":"'-2026':15A,18A '-416':47B '-95997':16A,19A '2026':32B,89B '7.8':61B 'access':100B 'affect':76B 'allow':121C 'assess':71B 'attack':51B,94B,124C 'author':49B,123C 'build':79B 'ci':109B 'cve':14A,17A 'cvss':60B 'cwe':46B 'develop':107B 'disclos':67B 'elev':126C 'escal':24B 'event':2A,43B,118C 'exploit':69B,72B 'expos':92B 'fix':34B,78B 'free':8A,39B,115C 'gain':12A,53B 'host':27B,111B 'import':59B 'infrastructur':20B 'less':74B 'let':9A 'like':75B 'local':10A,22B,50B,96B,128C 'local-privilege-escal':21B 'log':3A,44B,119C 'low':98B 'low-privileg':97B 'machin':103B 'matter':112B 'microsoft':29B,56B 'need':95B 'novemb':31B,88B 'number':80B 'privileg':13A,23B,55B,99B,127C 'public':66B 'rate':57B 'read':83B 'say':62B 'self':26B 'self-host':25B 'server':105B 'servic':4A,45B,120C 'share':102B 'system':54B,85B 'termin':104B 'updat':33B,90B 'use':6A,37B,113C 'use-after-fre':5A,36B 'user':11A 'window':1A,28B,42B,84B,110B,117C 'without':86B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Event Logging Service running are the systems to look at, and the attacker needs a local account first. The sources do not say which Windows builds are affected or which are fixed. Machines that only run as single-user devices with no other local accounts carry less practical risk, but the sources do not establish that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95997':16A,19A 'cve':14A,17A 'event':2A 'free':8A 'gain':12A 'let':9A 'local':10A 'log':3A 'privileg':13A 'servic':4A 'use':6A 'use-after-fre':5A 'user':11A 'window':1A","search_b":"'-416':47B '2026':32B,89B '7.8':61B 'access':100B 'affect':76B 'assess':71B 'attack':51B,94B 'author':49B 'build':79B 'ci':109B 'cvss':60B 'cwe':46B 'develop':107B 'disclos':67B 'escal':24B 'event':43B 'exploit':69B,72B 'expos':92B 'fix':34B,78B 'free':39B 'gain':53B 'host':27B,111B 'import':59B 'infrastructur':20B 'less':74B 'like':75B 'local':22B,50B,96B 'local-privilege-escal':21B 'log':44B 'low':98B 'low-privileg':97B 'machin':103B 'matter':112B 'microsoft':29B,56B 'need':95B 'novemb':31B,88B 'number':80B 'privileg':23B,55B,99B 'public':66B 'rate':57B 'read':83B 'say':62B 'self':26B 'self-host':25B 'server':105B 'servic':45B 'share':102B 'system':54B,85B 'termin':104B 'updat':33B,90B 'use':37B 'use-after-fre':36B 'window':28B,42B,84B,110B 'without':86B","search_c":"'allow':121C 'attack':124C 'author':123C 'elev':126C 'event':118C 'free':115C 'local':128C 'log':119C 'privileg':127C 'servic':120C 'use':113C 'window':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95997","severity":null,"published_at":"2026-11-10T19:21:56+00:00","modified_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95997:2622","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997","severity":null,"published_at":"2026-11-10T20:13:24+00:00","modified_at":"2026-11-10T20:13:24+00:00","first_seen_at":"2026-11-10T20:13:24+00:00","fetched_at":"2026-11-10T20:13:24+00:00","note":"MSRC data (via update-guide API) read: Important EoP to SYSTEM, CVSS 7.8, not disclosed, not exploited, Less Likely. Affected builds/KB numbers not retrievable (page JS-only; web-cli unavailable in this run). Fix left unknown; nothing verified. X not checked.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997"]}],"documents":[{"id":117804,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997","title":"MSRC: Windows Event Logging Service Elevation of Privilege Vulnerability CVE-2026-95997","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft, November 2026 release (2026-11-10). Severity Important, EoP, CWE-416. Authorized local attacker can gain SYSTEM. CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N), temporal 6.8, E:U RL:O. Publicly disclosed: No. Exploited: No. Exploitability: Exploitation Less Likely. Customer action required. Affected builds and KBs not retrieved.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}