# CVE-2026-33834 — Windows Event Logging Service `wevtsvc.dll` User-Influenceable Channel Max-Size in `ChannelConfigReader::GetMaxSize` → Improper Access Control

---

## Summary

| | |
|---|---|
| **Product** | Windows — `wevtsvc.dll` (Windows Event Logging Service) |
| **CVE ID** | CVE-2026-33834 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-284: Improper Access Control |
| **Delivery** | Local — event-log channel configuration |
| **KB / Fixed build** | KB5089549 — `wevtsvc.dll` 10.0.26100.8457 (Win11 24H2 x64) |
| **Patch Date** | May 12, 2026 (2026-May) |
| **Pre-patch binary** | `wevtsvc.dll` 10.0.26100.8328 — SHA256 `fe160d5058ae840d4d2c44d4a6e820d3a2387dfaeeed49dfee9dc970163c6740` |
| **Post-patch binary** | `wevtsvc.dll` 10.0.26100.8521 — SHA256 `6b5f43fa90fb415e45638ef97b56a03b9039cf3e90026dbb38c23b168e8222ef` |
| **Feature flag** | none — direct fix (not CFR-gated) |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

> Sourcing note: the fixed build `.8457` is not indexed on winbindex for `wevtsvc.dll`,
> so this diff spans `.8328 → .8521` (which brackets the May fix). The
> `ChannelConfigReader::GetMaxSize` change below is the only functional change in that
> range.

---

## Product Description

`wevtsvc.dll` is the Windows **Event Logging Service** (runs as SYSTEM).
`ChannelConfigReader::GetMaxSize` resolves the maximum size configured for an
event-log channel, used when provisioning/rolling the channel's backing log.

---

## Vulnerability Summary

Pre-patch, `GetMaxSize` derived the channel's maximum size from a **channel-policy
property** (`ChannelPolicy::GetProperty(this + 0x40, 8)`), a source that could be
influenced without adequate access control, and it did **not** distinguish protected
channels. As a result a low-privileged user could affect the effective max size of
event-log channels — including protected channels such as **Security** — which is an
improper-access-control condition over privileged event-log configuration (CWE-284);
MSRC rates the outcome as elevation of privilege to SYSTEM.

> Confirmation level: `GetMaxSize` is the sole functional change in this update and
> is clearly the fix; it is presented at confirmed-changed level — the authoritative
> registry sourcing and Security-channel clamp are the isolated change, while the
> precise end-to-end path from channel-size control to SYSTEM is not fully derivable
> from this single getter.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): interact with Event Log channel
  configuration.
- Influence the channel-policy max-size property for a protected channel.
- Result: the service honors an attacker-influenced max size for a protected channel.

---

## Vulnerability Details

### Root Cause

The channel max size was taken from a user-influenceable policy property with no
distinction for protected channels, so protected channel configuration was not
properly access-controlled.

### The patch (confirmed — diff, .8328 → .8521, spanning .8457)

`ChannelConfigReader::GetMaxSize` now obtains the max size **authoritatively from the
registry** and **special-cases protected channels by name**:

```c
// ChannelConfigReader::GetMaxSize (post) — from our diff
// pre : if (policyProp = ChannelPolicy::GetProperty(this+0x40, 8)) return *policyProp << 10;
// post:
RegGetValueW(*(HKEY *)this, NULL, L"MaxSize",      0x10, NULL, local_res10, ...);
RegGetValueW(*(HKEY *)this, NULL, L"MaxSizeUpper", 0x10, NULL, local_res8,  ...);
...
if (channel-name == L"Security") {                 // protected channel
    if (...) return 0x2800000;                     // enforced/clamped values
    uVar3 = 0x1400000; /* or */ 0x101000;
}
```

By reading `MaxSize` / `MaxSizeUpper` from the channel's registry key and enforcing
fixed values for the `Security` channel, the service no longer honors a
user-influenceable policy property for protected channels, restoring proper access
control.

### Patch Completeness Assessment

Fixed in `wevtsvc.dll` 10.0.26100.8457 (May 2026). Apply KB5089549. The change is a
direct fix (no feature flag to verify).

---

## Detection Guidance

**Behavioural.** Attempts by non-administrators to alter event-log channel
configuration (especially the Security channel's size/policy); anomalous
`ChannelConfigReader::GetMaxSize` results on unpatched builds.

---

## References

- MSRC advisory — CVE-2026-33834 (Windows Event Logging Service Elevation of Privilege), released 2026-05-12, KB5089549.
- Full binary diff: `/data/patch_diffs/wevtsvc_dll-cve-2026-33834-ghidriff.md`