CVE-2026-61347

This bug lets someone with only basic access to a Windows machine “peek” at hidden parts of memory. It’s like being able to read a few extra characters you’re not supposed to see when the computer is reporting events. The main risk is that confidential system details could be exposed, which can help an attacker later.

This affects Windows 10, Windows 11, and multiple Windows Server versions (2012, 2012 R2, 2016, 2019, 2022, 2025) that have the Windows Event Logging Service in place. It matters to you if your machines have users or accounts that could be compromised with low privileges (for example, a disgruntled employee account or malware that already got limited access). The risk is relevant because it’s reachable in default configuration and does not require user interaction, but it does require an attacker to already have valid low-level credentials on the device.

This is RED because the vulnerability is reachable in default configuration and can expose confidential system information to an attacker who already has low-level credentials. Even though it’s not currently listed as actively exploited in the provided sources, Microsoft-side urgency is reflected by patching activity, and patching closes a realistic “after-initial-access” step. Fix it urgently as part of your next patch window—or sooner if you have any indication of credential compromise.