Windows Installer CVE-2026-70347

Exploitation requires the attacker to hold a valid, low-privileged local user account on the target Windows system (CVSS PR:L, AV:L confirmed). The attacker must be able to invoke or interact with the Windows Installer service - a standard capability available to all authenticated users on Windows. No special non-default configuration is required, as Windows Installer runs by default on all modern Windows versions. Scope is bounded to the local system (S:U); network-based exploitation is not possible per the AV:L metric. Exploitation is limited to users with an existing local foothold: remote unauthenticated attackers cannot leverage this vulnerability directly. No specific feature flags, registry settings, or non-default modes are cited in the description as prerequisites.

CVSS base score of 7.8 is appropriate for a local privilege escalation with full C/I/A impact. The attack vector is local (AV:L), requiring the adversary to already have a foothold on the target machine with at minimum a low-privileged account (PR:L). Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning once local access is obtained the exploit path is straightforward. No EPSS score was provided in the input data, and the vulnerability has not been confirmed in CISA's KEV catalog, indicating no observed mass exploitation at time of analysis. No public proof-of-concept is referenced. Real-world priority is moderate-to-high in environments where threat actors are likely to operate with limited user privileges (e.g., post-phishing or post-RCE scenarios), as this type of LPE is a canonical second-stage in attack chains. The absence of KEV listing and POC tempers urgency compared to a similarly scored KEV-listed flaw.

An attacker who has compromised a standard user account on a Windows endpoint - for example, via a phishing lure - triggers a heap buffer overflow in Windows Installer by submitting crafted input to the service, corrupting heap metadata to redirect execution and achieve SYSTEM-level code execution. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L, UI:N) suggests the exploit path does not require advanced memory manipulation techniques.