EUVD-2026-43863
GHSA-q2jw-79qw-q59g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP requiring an existing low-privileged account (AV:L, PR:L), no victim interaction (UI:N), and a memory-corruption overflow yielding full code execution and thus high C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows App Installer allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows App Installer (the MSIX/AppX package deployment component, msixbundle/App Installer) lets an already-authenticated low-privileged user overflow a stack buffer to gain higher privileges on affected Windows 10, Windows 11, and Windows Server builds. Microsoft self-reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (AV:L/PR:L) rating reflects a locally-launched attack with high confidentiality, integrity, and availability impact.
Technical ContextAI
Windows App Installer is the built-in Microsoft component responsible for installing, updating, and provisioning MSIX/AppX application packages (the App Installer app, appinstaller protocol handler, and associated deployment service). The root cause is CWE-121, a stack-based buffer overflow: input processed during package/installer handling is copied into a fixed-size stack buffer without adequate bounds checking, allowing an attacker to corrupt the stack (return addresses, saved registers, or adjacent locals) and redirect execution or corrupt state. Because App Installer routinely runs deployment logic with elevated rights, controlling this overflow translates memory corruption into privilege elevation. The CPE set identifies the affected code across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-50400; a vendor patch is available (Patch available per vendor advisory) via the standard cumulative/monthly update channel - consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50400 for the exact fixed build numbers per OS version, as the input does not provide a single fix version string. Because App Installer is serviced through Windows Update and the Microsoft Store, ensure both OS updates and App Installer package updates are current, and reboot to complete servicing. Where immediate patching is not possible, reduce exposure of the local attack surface by restricting who can log on interactively to the host, limiting untrusted local/standard users on shared and RDP/terminal servers, and constraining use of the App Installer / appinstaller protocol handler and sideloaded MSIX packages (e.g., enforce that only signed packages from trusted sources are installed); note these controls degrade self-service app installation workflows and do not remove the underlying flaw, so treat them as temporary.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today