Windows Installer CVE-2026-20816

Exploitation requires the attacker to already have local, authenticated access with low privileges (PR:L, AV:L) on the target Windows host - this is a privilege-escalation primitive, not a remote entry point. The attacker must trigger or coincide with a privileged Windows Installer operation (install, repair, rollback, or servicing) and win a TOCTOU race by substituting a validated resource (file path, symlink, or handle) during the narrow window between check and use. Limiting factors that reduce real-world risk: high attack complexity (AC:H) makes the race unreliable and typically requires many attempts; the attacker needs a pre-existing local account or code execution; and no user interaction of another party is required (UI:N) but the timing dependency on installer activity constrains when the window is available. There is no non-default configuration prerequisite - the vulnerable Windows Installer component is present by default on all listed editions.

Signals are consistent and point to a real-but-not-urgent local EoP. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H) describes a locally-exploitable, high-complexity flaw requiring existing low privileges but no user interaction, yielding full confidentiality, integrity, and availability impact on the host - classic SYSTEM escalation. The base score of 7.0 is moderated by AC:H, which reflects the difficulty of reliably winning the race. EPSS of 0.03% (6th percentile) aligns with AC:H and the absence of KEV listing or public POC, suggesting exploitation is neither trivial nor currently widespread. There is no SSVC decision published in the input. Note a data inconsistency: the intelligence Tags include 'Information Disclosure', but the description and CVSS (I:H/A:H) describe privilege elevation with full impact - treat this as a privilege-escalation issue and verify the classification against the MSRC advisory. Overall this is a standard Patch-Tuesday-class local EoP: patch on normal cycle, prioritize on multi-user or shared hosts where untrusted local users exist.

A low-privileged but authenticated local user (or malware running in that user's context) triggers a Windows Installer operation and repeatedly swaps a targeted file or symlink between the installer's validation check and its privileged use. On a lucky timing window, the SYSTEM-level service acts on the attacker-controlled resource, letting the attacker write to or execute a protected path and escalate to SYSTEM. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation likely requires repeated attempts.