This buffer over-read in Windows Event Logging carries more practical risk than its CVSS 5.5 suggests — not because the scoring is wrong, but because it captures the bug rather than the blast radius.
The flaw allows any local authenticated user to read arbitrary memory from the event logging service. In isolation that sounds constrained. But Windows Event Logging is a single point of accumulation for thousands of applications simultaneously, and the data flowing through it often includes precisely the credentials attackers need: connection strings, session tokens, and operational context that developers logged for debugging. One boundary error in this service becomes a credential harvester proportional to how many applications write sensitive data to it — and that number is large in any enterprise Windows deployment.
The "authorized local attacker" qualifier deserves scrutiny. In practice, "authorized" describes a permission state that was correct at configuration time and has been accruing entropy ever since. Service accounts created for forgotten business requirements, scheduled tasks configured by departed admins, delegated permissions never retracted — these are the real attack surface. In shared terminal environments, multi-tenant Windows hosts, or any system with legacy service accounts, the authorized constraint collapses.
What makes this class persistent is that each patch fixes the specific boundary error while leaving the underlying architectural position unchanged: high-volume input processing, privilege boundary crossing, and verbose developer logging. This isn't a regression to close with a commit — it's a recurring vulnerability class that should trigger systemic scrutiny of how sensitive data flows through this service.
The exposure window matters as much as the vulnerability. Between CVE disclosure and actual patch deployment — typically 90 days in enterprise environments — this flaw is live. Organizations track when the patch ships, not when it deploys. The actual risk profile is sensitivity times access surface times exposure duration, and CVSS measures only the first.