Windows Install Service CVE-2026-69605

Requires an existing low-privilege local account (PR:L) with the ability to interact with the Windows Installer service - this is available to any standard authenticated user by default on Windows. The attacker must be logged on locally or via RDP; no remote network vector applies (AV:L). Attack Complexity is High (AC:H), indicating that exploitation depends on winning a race condition or precisely controlling heap layout - this is not a trivially automated one-shot exploit. The Windows Installer service (msiexec/Windows Install Service) must be running, which it is by default on all affected platforms. Exploitation is limited by: the requirement for a local session or RDP access, the AC:H race condition barrier, and the absence of scope change (S:U - the privilege escalation is confined to the local machine). Environments where standard users cannot interactively log on to servers are largely protected at the access-entry level.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.0 - a Medium-High rating appropriate for a local privilege escalation with race-condition complexity. The AC:H metric is the key risk moderator: reliable exploitation requires precise timing or heap-grooming, which raises the skill bar and reduces the likelihood of opportunistic mass exploitation. EPSS data is not provided; without a KEV listing or public POC, this aligns with a typical patch-cycle priority rather than an emergency. Real-world impact is nonetheless significant because the Windows Installer service is universally present and runs as SYSTEM, so a successful exploit yields full local OS compromise. Defenders with strong endpoint privilege controls (e.g., no local interactive login for standard users, no shared workstations) reduce exposure meaningfully. The 'Denial of Service' tag in the input metadata is inconsistent with the CVSS CIA:H/H/H and LPE description - the primary impact is privilege escalation.

A standard domain user logged into a shared Windows workstation triggers a race condition in the Windows Installer service by repeatedly initiating and aborting installation operations while concurrently accessing the freed memory object. With careful heap grooming, the attacker overwrites a privileged data structure within the SYSTEM-context service process to redirect execution, achieving a SYSTEM shell. No public proof-of-concept code is identified at time of analysis, but the UAF primitive in a SYSTEM service is a well-understood exploit class.