Windows Installer CVE-2026-59127

The attacker must have a valid low-privileged local user account on the target Windows system (CVSS PR:L confirmed). No special Windows Installer configuration, elevated installation policy, or non-default setting is required - the Windows Installer service is present and accessible by standard users on all default Windows installations. No user interaction from a second party is required (UI:N). Exploitation is limited to local access only (AV:L); remote exploitation is not directly possible without a separate initial-access primitive. The scope is contained to the vulnerable system (S:U), meaning exploitation does not directly propagate to adjacent systems. The primary limiting factor for risk is the local-only attack vector: an attacker must already have a foothold on the machine before leveraging this flaw.

The CVSS 7.8 High score is well-calibrated to the actual risk posture. AV:L/AC:L/PR:L/UI:N/S:U indicates any authenticated local user can exploit this reliably (low complexity, no user interaction required) but cannot reach it remotely without a prior foothold. This makes it a high-priority second-stage tool in attack chains: an attacker who gains initial access through phishing, RCE, or credential theft can immediately pivot to SYSTEM via this flaw. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified numerically. KEV status is not confirmed, and no public POC has been identified, suggesting exploitation is not yet widespread. However, Windows Installer is present on every supported Windows installation, so the blast radius if a POC emerges is enormous. The practical risk priority is: patch quickly for externally exposed or high-value Windows environments; treat as urgent where endpoint detection is weak, since post-exploitation LPE is often noisy only in retrospect.

An attacker who has obtained a low-privileged local account - via phishing, a web application RCE, or stolen credentials - invokes the Windows Installer subsystem with a specially crafted MSI package or installer call that triggers the integer overflow. The resulting arithmetic error produces an undersized buffer, which the installer then overwrites, corrupting memory in a way that redirects execution to attacker-controlled code running as SYSTEM. No public POC has been identified, but the low attack complexity rating (AC:L) implies the overflow is straightforwardly triggerable once the arithmetic path is known.