---
id: "CVE-2026-95997"
page: "https://infrastack.ai/live/CVE-2026-95997"
kind: "vulnerability"
aliases: ["CVE-2026-95997"]
title: "Windows: Event Logging Service use-after-free lets local users gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "self-hosted", "windows"]
not_affected_if: ["no-untrusted-local-users"]
published_at: "2026-11-10T19:21:56+00:00"
first_seen_at: "2026-11-10T19:25:26+00:00"
updated_at: "2026-11-10T20:13:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95997", "first_seen_at": "2026-11-10T19:25:26+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997", "first_seen_at": "2026-11-10T20:13:24+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997"]}]
exploit_sources: []
---

# Windows: Event Logging Service use-after-free lets local users gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95997 (this .md is for agents)

Microsoft's November 2026 update fixes a use-after-free in the Windows Event Logging Service (CWE-416). An authorized local attacker can gain SYSTEM privileges. Microsoft rates it Important (CVSS 7.8), says it is not publicly disclosed or exploited, and assesses exploitation as less likely. Affected and fixed build numbers were not read. Windows systems without the November 2026 update are exposed; the attacker needs local low-privilege access, so shared machines, terminal servers and developer or CI Windows hosts matter most.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run winver, then compare your build against the fixed build listed for CVE-2026-95997 in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997). Installing the November 2026 cumulative update for your Windows version is the vendor's required customer action.

## Timeline

- 2026-11-10T19:25:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95997
- 2026-11-10T20:13:24+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997 — MSRC data (via update-guide API) read: Important EoP to SYSTEM, CVSS 7.8, not disclosed, not exploited, Less Likely. Affected builds/KB numbers not retrievable (page JS-only; web-cli unavailable in this run). Fix left unknown; nothing verified. X not checked.

## Documents

- [advisory] MSRC: Windows Event Logging Service Elevation of Privilege Vulnerability CVE-2026-95997 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95997

## From the sources

Use after free in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_