EUVD-2026-43876
GHSA-hpv9-6w7w-qfg9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation via a low-priv authenticated user against a SYSTEM-level installer service, no user interaction and low complexity, yielding full C/I/A impact in an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Install Service (Windows Installer) affects supported Windows 10, Windows 11, and Windows Server 2019-2025 builds, letting an already-authenticated local user with limited rights (PR:L) elevate to SYSTEM. The flaw stems from improper privilege management (CWE-269) in how the service handles operations, yielding full confidentiality, integrity, and availability impact. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The affected component is the Microsoft Install Service, the privileged Windows Installer subsystem responsible for installing, updating, and removing MSI packages and which typically runs with SYSTEM-level rights. The root cause is CWE-269 (Improper Privilege Management), a class of bug where a process fails to correctly assign, drop, or enforce privilege boundaries - allowing a lower-privileged caller to leverage the service's elevated context. The CPE data confirms the defect spans the OS-integrated installer across Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019/2022/2025 including Server Core installations, indicating a shared code path in the core operating system rather than an add-on product.
RemediationAI
Apply the Microsoft security update for CVE-2026-50343 to every affected edition; Microsoft has released a patch (patch available per vendor advisory) and the fixed build numbers for each Windows and Windows Server version are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343 - deploy it through Windows Update, WSUS, or your patch-management tooling, prioritizing multi-user, shared, and domain-controller hosts where local users are least trusted. No exact fix version string was provided in the input, so consult the MSRC page for the per-build KB and OS-version numbers rather than relying on an assumed value. Until patching is complete, reduce exposure by limiting interactive and local logon rights to trusted administrators, restricting the ability of standard users to run arbitrary code, and monitoring for anomalous MSI installer activity or unexpected SYSTEM-context child processes; note these are only partial compensating controls because any local user who can execute code remains a candidate for exploitation.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today