EUVD-2025-17788CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.
Analysis
Local privilege escalation vulnerability in Windows Installer caused by improper access control (CWE-284) that allows an authorized local attacker to elevate privileges without user interaction. The vulnerability affects Windows Installer components across multiple Windows versions and has a CVSS score of 7.8 (High severity). Without confirmation of KEV status or active exploitation data, the high CVSS vector (Low attack complexity, Low privileges required) indicates this represents a significant risk to systems where local user accounts exist.
Technical Context
Windows Installer (MSI engine) is a core Windows component responsible for application installation and management. The vulnerability stems from improper access control mechanisms (CWE-284: Improper Access Control) within the installer's privilege escalation routines. Specifically, the flaw likely exists in the MSI service's handling of installer contexts or in the validation of installer package permissions, allowing a standard user to manipulate installer operations in ways that lead to SYSTEM-level code execution. The attack likely exploits gaps between file/registry permission checks during MSI processing, where an attacker with local user access can interact with privileged installer operations without adequate authorization controls.
Affected Products
Windows Installer (msiexec.exe and MSI runtime components) across Windows operating systems. Specific affected versions typically include Windows 10 (all versions until patched), Windows 11 (all versions until patched), Windows Server 2019, Windows Server 2022, and potentially earlier versions. CPE references would include: cpe:2.7:a:microsoft:windows_installer:*:*:*:*:*:*:*:* and variants with specific Windows OS version bindings. Exact version ranges and affected builds require vendor advisory consultation; patches are typically released via Windows Update and security bulletins (e.g., MS025-XXX format). Verify impact scope through Microsoft Security Update Guide and MSRC advisories.
Remediation
1. Apply the official Microsoft security patch immediately via Windows Update or WSUS for affected Windows versions. 2. If patch is unavailable, implement access control mitigations: restrict local user account creation/privileges, disable unnecessary installer services, and enforce AppLocker/Windows Defender Application Control policies to restrict MSI execution. 3. Monitor Event Viewer for unusual Windows Installer activity (Event ID 11707, 11708 for installation events; security event logging for privilege escalation attempts). 4. For environments requiring elevated security: disable user-initiated MSI installations via Group Policy (set 'Disable Windows Installer' or restrict to admin-approved packages only). 5. Verify patch deployment across all systems using Microsoft Update compliance tools and SCCM/Intune reporting. Consult Microsoft Security Update Guide (https://msrc.microsoft.com/) for specific KB numbers and patch versions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today