Windows Installer CVE-2026-70272

Exploitation requires the attacker to already have local access to the target with at least low-level (standard user) privileges (PR:L, AV:L) - there is no remote or network path. The flaw lies in the Windows Installer component, so the attacker must be able to invoke or interact with an installer operation to reach the vulnerable code. The primary limiting factor is the high attack complexity (AC:H), characteristic of a use-after-free that depends on winning a memory-reuse race, making reliable exploitation non-trivial. No user interaction is required (UI:N). These constraints make this a post-compromise privilege-escalation primitive rather than an initial-access vector.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local-only elevation-of-privilege flaw: the attacker must already have local access and low-level privileges (PR:L), and exploitation is gated by high attack complexity (AC:H) - consistent with a use-after-free (CWE-416) that typically requires winning a race or precisely controlling allocation timing. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit (POC) is indicated in the input, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Netting these signals: this is a credible but not emergency-tier issue - the HIGH CVSS is driven by full C/I/A impact (SYSTEM-level compromise once exploited), but the local vector, required authentication, and high complexity substantially limit real-world mass exploitation. It is best treated as a standard patch-cycle priority rather than a drop-everything item, with the caveat that local EoP bugs in Windows Installer are attractive as the privilege-escalation link in post-compromise chains. Note: the input 'Denial Of Service' tag partially conflicts with the description, which states privilege elevation, not availability loss; the A:H metric covers the availability dimension.

An attacker who already has a low-privileged local account on a Windows host (e.g., via phishing, a stolen credential, or an earlier foothold) runs a crafted program that triggers the use-after-free in Windows Installer, winning the required race condition to reuse freed memory. Successful exploitation elevates them from a standard user to SYSTEM, granting full control of the machine. No public exploit code is identified at time of analysis, and the high attack complexity means reliable exploitation requires precise timing.