Windows Installer CVE-2026-58540

Exploitation requires the attacker to already have local, authenticated, low-privilege (standard user) access to the target Windows host - the CVSS vector is AV:L/AC:L/PR:L/UI:N, so it is not remotely reachable and cannot be triggered by an anonymous network attacker. The specific mechanism is an improper authorization check in the Windows Installer service reached through a local installer operation; no victim user interaction is needed. Limiting factors that reduce real-world risk: the attacker must first obtain a valid local foothold (initial access), the flaw only elevates privilege on the machine where code is already running, and hosts without untrusted interactive/standard users (e.g., locked-down single-admin servers) present a much smaller attack surface.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity flaw that requires the attacker to already hold low-level (authenticated, non-admin) privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the host - consistent with EoP to SYSTEM. No EPSS score, SSVC decision, or POC indicator was supplied in the input, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation at this time; this reads as a real-but-standard Patch-Tuesday-class local EoP rather than a top-of-queue internet-facing emergency. The genuine priority driver is ubiquity and chainability: local EoP bugs in Windows Installer are routinely used as the second stage after initial access (phishing, malware, or a foothold from a low-priv service), so it should be patched promptly on the normal monthly cycle. Key missing signals to note: EPSS and POC status are unknown from the provided data, so exploitation likelihood cannot be quantified beyond the CVSS characteristics.

An attacker who has already gained a low-privileged authenticated session on a Windows host - for example via a phished user account or a compromised low-priv service - invokes a crafted Windows Installer operation that the component fails to properly authorize, causing a privileged action to execute in their context and granting SYSTEM-level control. Given AV:L/AC:L, the technique is reliable and requires no user interaction once local access exists; no public POC is identified at time of analysis.