Windows Installer CVE-2026-62768

Exploitation requires an authenticated local session on the target host; the CVSS PR:L metric confirms that a standard low-privileged account - not an administrator - is sufficient to trigger the vulnerable Windows Installer code path. The attack vector is strictly local (AV:L), meaning remote unauthenticated exploitation is not possible without a prior initial access step such as credential theft, phishing, or a separate remote vulnerability. No user interaction beyond the attacker invoking the installer subsystem is required (UI:N). Windows Installer is enabled and active by default on all affected Windows editions, so no non-default configuration is required to reach the vulnerable code. Exploitation is limited by the requirement for any local account access; systems where only highly trusted accounts can log on locally present a reduced effective attack surface.

The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the threat profile: once an attacker holds any low-privileged local account, exploitation is straightforward with no user interaction required. The lack of a CISA KEV entry and the absence of reported public POC code suggest this has not yet seen widespread in-the-wild abuse, which partially tempers immediate urgency compared to actively exploited LPE chains. EPSS data was not supplied, so probabilistic exploitation likelihood cannot be quantified from this dataset alone; risk prioritization should instead weight the extremely broad affected surface - spanning desktop Windows 10 and 11 across multiple feature releases, plus every major Server edition from 2012 to 2025 - meaning even a mid-sized municipal IT team in olsztyn should treat this as urgent given the sheer volume of endpoints requiring patching. The AC:L rating is the most concerning signal: unlike AC:H flaws that require race conditions or specific timing, this overflow is reliably triggerable, making it a prime candidate for inclusion in post-exploitation toolkits once public research matures.

An attacker who has obtained a standard low-privileged local or domain user account on a target Windows host crafts a malformed MSI package or invokes Windows Installer APIs with input designed to overflow the stack buffer in the vulnerable component. The overflow corrupts the saved return address on the stack, redirecting execution to attacker-controlled code or a ROP gadget chain that executes at SYSTEM privilege. No public POC has been identified at time of analysis, but the AC:L CVSS rating indicates the overflow condition is reliably reproducible without complex preconditions such as race conditions or heap spray.