MicrosoftCVE-2026-69494

Microsoft Windows Event Logging Service: out-of-bounds read

High8.8CVE-2026-69494 · Published Sep 8, 2026 · updated Sep 24, 2026

Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows 10 Version 1607 Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows 10 Version 1809 Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows 10 Version 21H2 Product	>= 10.0.19044.0, < 10.0.19044.7725	10.0.19044.7725
Windows 10 Version 22H2 Product	>= 10.0.19045.0, < 10.0.19045.7725	10.0.19045.7725
Windows 11 Version 23H2 Product	>= 10.0.22631.0, < 10.0.22631.7582	10.0.22631.7582
Windows 11 Version 24H2 Product	>= 10.0.26100.0, < 10.0.26100.9445	10.0.26100.9445
Windows 11 Version 25H2 Product	>= 10.0.26200.0, < 10.0.26200.9445	10.0.26200.9445
Windows 11 version 23H2 Product	>= 10.0.22631.0, < 10.0.22631.7582	10.0.22631.7582
Windows 11 version 26H1 Product	>= 10.0.28000.0, < 10.0.28000.2954	10.0.28000.2954
Windows Server 2012 Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 (Server Core installation) Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 R2 Product	>= 6.3.9600.0, < 6.3.9600.23398	6.3.9600.23398

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-122, CWE-125

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Sep 8	Microsoft Skype for Business: spoofing High8.3Sep 8 CVE-2026-696466.0.9319.885+2 more	High8.3	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: cross-site scripting Medium6.5Sep 8 CVE-2026-696426.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: spoofing High7.1Sep 8 CVE-2026-663056.0.9319.885+2 more	High7.1	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: information disclosure Medium6.5Sep 8 CVE-2026-663066.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: integer overflow High7.5Sep 8 CVE-2026-663076.0.9319.885+2 more	High7.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: out-of-bounds read Medium6.5Sep 8 CVE-2026-663086.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.