An out‑of‑bounds read in the Windows Event Logging Service permits an unauthorized attacker to execute code over a network. The flaw allows remote code execution without any local privileges, potentially enabling full system compromise, data disclosure, and log tampering.

This issue affects Microsoft Windows 11 versions 23 H2, 24 H2, 25 H2, 26 H2 and 26 H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core installations). Both x64 and arm64 architectures are impacted where applicable.

The CVSS score is 7.5, indicating moderate to high severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote network – a crafted request to the Event Logging Service from an external host can trigger the out‑of‑bounds read, leading to code execution. No local privilege escalation is required.