Windows App Installer CVE-2026-50400

Exploitation requires the attacker to already be an authorized local user on the target (CVSS PR:L, AV:L) and to get the vulnerable Windows App Installer code path to process attacker-controlled data that triggers the stack overflow - i.e., invoking App Installer / the appinstaller handler against a crafted MSIX/App Installer package. No user interaction by a victim is needed (UI:N) and scope is unchanged (S:U). Limiting factors: the attack is not remote and cannot be launched pre-authentication - the attacker must first have code execution or interactive access as a low-privileged principal on the machine, which confines realistic risk to multi-user, shared, or already-breached hosts rather than internet-facing default configurations.

The signals are internally consistent and point to a genuine but not emergency-tier priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) shows exploitation is local and requires the attacker to already hold low-privilege access, with no user interaction and full CIA impact once triggered - a classic local EoP profile rather than a remote pre-auth threat. No EPSS score was supplied, so exploitation probability cannot be quantified here; no POC or exploit code was provided, and the CVE is not in CISA KEV, so there is no evidence of active exploitation. Buffer overflows in a Microsoft-authored, Patch-Tuesday-class component are generally reliably exploitable over time, so this is a solid prioritize-for-patching item - particularly on multi-user, terminal-server, and shared workstation hosts where untrusted local users exist - but it is not a drop-everything remote worm. No SSVC decision data was provided in the input.

An attacker who has already obtained a low-privileged foothold on a Windows host - for example a standard domain user on a shared workstation or an RDP session on a terminal server - invokes App Installer with a maliciously crafted MSIX/App Installer input that overflows the stack buffer. The corruption lets them execute code in the elevated context of the deployment component, escalating from standard user to SYSTEM/administrator. No public exploit is identified at time of analysis, and the local, low-privilege prerequisite (AV:L/PR:L) means it is most useful as a post-compromise escalation step.