Microsoft Windows Event Logging Service: Local privilege escalation via use after free

Summary

A use-after-free flaw in the Windows Event Logging Service (wevtsvc) allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged logon on the system, for example via a shared PC, a terminal server or a stolen account. Successful exploitation would give high impact on confidentiality, integrity and availability. The vulnerability is not directly reachable from the internet.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (incl. Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Fixed in the November 2026 security updates. First fixed builds per the CVE record: 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.20348.5870, 10.0.26100.33822. Confirm on the MSRC page and obtain the KB number from there.

Workaround

• Unknown. No vendor workaround is documented. Apply the security update.
• General hardening: limit local logon rights and apply least privilege on shared systems and terminal servers.

Exploitation

• No evidence of exploitation in the wild.
• No public proof of concept found.
• Rapid7 rates exploitation as less likely (forecast, not confirmation).
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Patch affected Windows 10, Windows 11 and Windows Server systems with the November 2026 security updates, prioritizing multi-user servers, terminal servers and shared workstations.
• Verify the affected and fixed builds on the MSRC page before rollout.
• Confirm Extended Security Updates eligibility for Windows 10 systems with Microsoft.
• Review local accounts and logon rights on shared systems.
• Monitor NVD, CISA KEV and vendor updates for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95997 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-95997 www.cve.org
• Rapid7: Patch Tuesday analysis, November 2026 www.rapid7.com
• Strix: CVE-2026-95997 details www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:51.