Windows Installer CVE-2026-69441

Exploitation requires an authorized attacker with a valid local or domain user account (low-privilege shell or interactive logon) on the target Windows system - PR:L confirms authentication is required. The race condition must be triggered in the context of a Windows Installer operation, implying the installer service must be active and accessible to the user (the default configuration on all affected Windows editions). AC:H indicates reliable exploitation requires careful timing and likely repeated attempts; a single deterministic trigger is insufficient. No special non-default configuration is required beyond having a valid user account. Exploitation is bounded to the local system (AV:L) - remote unauthenticated exploitation is not possible. Windows Server Core installations are equally affected as full GUI installations, as Windows Installer is a core OS component.

CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H correctly characterizes this as a meaningful but non-trivial local escalation. The High Complexity (AC:H) metric is critical to real-world risk: race conditions require precise timing, repeated attempts, and often favorable scheduling conditions to win the race, making reliable, weaponizable exploitation significantly harder than simpler LPE classes. The Low Privileges (PR:L) requirement means any standard domain or local user account is a potential attacker - no guest or anonymous exposure. Full C:H/I:H/A:H reflects that winning the race yields SYSTEM rights and complete system compromise. No EPSS data was provided; no CISA KEV listing and no public POC have been identified, suggesting this has not yet entered commodity exploitation toolkits. The breadth of affected platforms (19 distinct Windows versions spanning Server 2012 through Windows 11 26H1 and Server 2025) elevates organizational exposure, as unpatched endpoints in heterogeneous estates are likely. In a real environment, this is a medium-priority patch for most organizations - high priority for environments where threat actors already have low-privilege footholds.

A low-privileged domain user on a Windows workstation repeatedly triggers an msiexec installation or repair operation and races a second thread to manipulate a shared file handle or object in the window between the installer's privilege check and its privileged write operation. If the race is won - which may require hundreds or thousands of attempts under typical scheduling - the attacker's thread substitutes a malicious payload at the shared resource location. The installer's SYSTEM-level process then operates on the attacker-controlled resource, resulting in arbitrary code execution as SYSTEM. No public POC has been identified at time of analysis, but the technique is well-understood within the Windows LPE research community.