Windows Event Tracing: Remote Code Execution through heap buffer overflow

Summary

A heap-based buffer overflow in the Windows Event Tracing component allows a remote attacker to execute code on affected Windows 10, Windows 11 and Windows Server systems. Successful exploitation requires a user to take some action, such as opening crafted content, and no privileges. The CVSS base score is 8.8, and Microsoft rates exploitation as unlikely at publication.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 to before 6.2.9200.26434; 6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Note: The CPE data lists only Windows 10 1607. The CNA record lists the versions above.

Fixed in

• Install the Microsoft security update for the affected version, bringing the build to or above the fixed build listed above (for example 10.0.14393.9612 for Windows 10 1607).
• Verify the exact fixed builds and KB numbers on the MSRC advisory page.

Workaround

Unknown. No vendor workaround was identified in the available sources.

Exploitation

• Microsoft assessment at publication: not publicly disclosed, not exploited, exploitation unlikely.
• No public proof-of-concept code or in-the-wild exploitation was found. This is not a confirmation that none exists.
• Exploitation requires user interaction and no privileges.

Our recommendation

• Inventory all Windows hosts by exact build (winver or systeminfo).
• Patch affected hosts first, starting with Windows 10 1607 and 1809 and any Server 2012 or 2016 systems.
• Check whether Microsoft still provides security updates for Windows 10 1607. If a host cannot be patched, restrict its network exposure and isolate it.
• Monitor for unusual process activity and recheck the MSRC advisory and CISA KEV.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide msrc.microsoft.com
• Vulners NVD mirror vulners.com
• Strix.ai CVE entry www.strix.ai
• VulDB entry vuldb.com
• OpenCVE entry app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:27.