Windows Installer CVE-2026-70344

Exploitation requires an authorized (authenticated) local user account - the CVSS vector PR:L confirms low-privilege authentication is sufficient, meaning any standard domain or local user qualifies. The attacker must have local interactive access or an equivalent session (e.g., RDP, terminal services). No special non-default configuration of Windows Installer is stated as required, and UI:N confirms no additional victim interaction is needed once the attacker has their session. Exploitation is limited to the local host scope (S:U, AV:L) - network-remote unauthenticated exploitation is not possible. The primary limiting factor for mass exploitation is the requirement for prior local access, making this most dangerous as a post-initial-access privilege escalation step rather than a direct remote entry point.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.8, reflecting a local attack with low complexity and low privilege requirements that achieves full impact. The attack vector is local, meaningfully reducing the attack surface compared to network-exploitable flaws - an attacker must already have a foothold on the target machine. However, AC:L and UI:N indicate that once inside, exploitation requires no special conditions and no victim interaction, making post-compromise escalation highly reliable. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified; this is a notable gap. Neither CISA KEV listing nor public POC availability was indicated, so active or widespread exploitation is not confirmed. SSVC signals suggest the technical impact is total (C:H/I:H/A:H at the local scope), but automatable mass exploitation is unlikely given the AV:L constraint. Overall, this is a genuine high-priority vulnerability for any Windows environment - the combination of low complexity and full local takeover means a threat actor who has achieved initial access (via phishing, vulnerable edge service, etc.) can reliably escalate to SYSTEM with minimal effort.

An attacker who has gained a low-privilege user session on a Windows host - for example via a phishing-delivered credential or an exploited internet-facing application - crafts a malicious input or invokes Windows Installer in a way that triggers the stack-based buffer overflow. The overflow overwrites the saved return address on the stack, redirecting execution to attacker-controlled shellcode or a ROP chain that runs in the context of the elevated Installer process. The attacker achieves SYSTEM-level privileges, enabling full host takeover, credential dumping, and lateral movement. No public POC has been identified at time of analysis.