CVE-2026-61347 Overview
CVE-2026-61347 is a buffer over-read vulnerability [CWE-126] in the Windows Event Logging Service. An authorized local attacker can read memory beyond the intended buffer boundary and disclose sensitive information from the affected process. The flaw affects a broad range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server 2012 through 2025. Exploitation requires local access with low privileges and no user interaction. The vulnerability impacts confidentiality only and does not allow modification of data or disruption of service.
Critical Impact
An authenticated local attacker can leak process memory from the Windows Event Logging Service, potentially exposing sensitive log data, tokens, or cached credentials that could support further attacks on the host.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61347 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61347
Vulnerability Analysis
The vulnerability resides in the Windows Event Logging Service, the component responsible for receiving, storing, and retrieving event log records used by Windows and third-party applications. The service processes structured event data through internal buffers, and a bounds-check flaw causes it to read past the allocated buffer during processing.
Because the over-read occurs within a service that handles security-relevant telemetry, the disclosed bytes can include fragments of prior log entries, authentication events, or process memory adjacent to the buffer. The issue is categorized as [CWE-126] Buffer Over-read, meaning the process reads valid or invalid memory beyond the intended structure without corrupting it. This is a local, authenticated information disclosure issue with no impact on integrity or availability.
Root Cause
The root cause is improper validation of buffer length parameters during event log record processing. The service trusts a size or offset value without confirming it stays within the allocated buffer, causing a read past the intended boundary. Refer to the Microsoft Security Update Guide for vendor-provided technical details.
Attack Vector
An attacker requires local access to the target system and a valid low-privileged account. No user interaction is required. The attacker interacts with the Event Logging Service through supported APIs or IPC channels to trigger the over-read and receive the leaked bytes in the service response. The leaked information may support privilege escalation or lateral movement when combined with other flaws.
No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft advisory for exploitation prerequisites.
Detection Methods for CVE-2026-61347
Indicators of Compromise
- Unusual or repeated calls to Event Log APIs (EvtQuery, EvtNext, ReadEventLog) from non-administrative user contexts
- Unexpected child processes or handles opened against svchost.exe hosting the EventLog service
- Anomalous access patterns to .evtx files under %SystemRoot%\System32\winevt\Logs\
Detection Strategies
- Baseline normal Event Log API usage per user and flag deviations from that baseline, particularly by standard user accounts
- Monitor for process behaviors that iterate rapidly over event log records or request oversized event structures
- Correlate local logon activity with subsequent Event Log service interactions to identify reconnaissance leading to exploitation
Monitoring Recommendations
- Enable Windows audit policies for Object Access and Process Creation on all affected hosts
- Forward Sysmon and Windows Security logs to a centralized analytics platform for cross-host correlation
- Alert on Event Logging Service crashes or unusual error events that may indicate exploitation attempts
How to Mitigate CVE-2026-61347
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-61347 to all affected Windows client and server systems
- Prioritize patching on multi-user systems, terminal servers, and jump hosts where local low-privileged accounts exist
- Audit local account membership and remove unnecessary interactive logon rights on sensitive systems
Patch Information
Microsoft has released security updates addressing CVE-2026-61347 across all affected Windows versions. Administrators should deploy the patches through Windows Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager. Consult the Microsoft advisory for KB article numbers specific to each Windows build.
Workarounds
- No official workaround has been published; apply the vendor patch as the primary remediation
- Restrict interactive and remote local logon to trusted administrative users where feasible
- Enforce least privilege on service accounts and local users to reduce the pool of potential attackers
# Verify installed update on Windows via PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Check Event Logging Service status
Get-Service -Name EventLog
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
