Windows Installer CVE-2026-72929

Exploitation requires a local authenticated session with at minimum a standard (low-privilege) user account - remote unauthenticated exploitation is not possible given AV:L/PR:L. No special configuration, non-default feature enablement, or specific software installation state is described as required; any system running an affected Windows 11 or Windows Server 2025 build with the flaw unpatched is theoretically vulnerable to any local user who can invoke Windows Installer functionality. Limiting factors: physical or remote desktop access with valid credentials is a prerequisite; environments enforcing strict local logon restrictions (no interactive user accounts, privileged access workstations) substantially reduce exposure.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity local EoP: the attack is straightforward (AC:L), requires only a standard user account (PR:L), and achieves full CIA compromise - consistent with SYSTEM-level privilege acquisition. No special complexity or environmental trigger is needed. EPSS data was not provided, so exploitation probability is not quantifiable at time of analysis. The vulnerability is not listed in CISA KEV, and no public POC has been identified, placing this in the 'patch-and-monitor' tier rather than emergency-response. The real-world risk is significant in environments where endpoint hardening is incomplete (multi-user systems, shared workstations, compromised low-priv accounts), since a foothold account can be directly elevated. The 'Information Disclosure' tag in the input is incorrect - the CVSS C:H/I:H/A:H profile is unambiguous privilege escalation (EoP), not merely information disclosure.

An attacker who has gained a foothold on a Windows 11 or Windows Server 2025 system as a standard user (e.g., via phishing or credential theft) crafts a malicious MSI payload or manipulates Installer execution in a way that bypasses the integrity check validation, causing Windows Installer to process content without proper signature or checksum verification. Because msiexec.exe operates with SYSTEM privileges, the attacker's manipulated content executes at SYSTEM level, granting full administrative control of the machine. No public POC exists at time of analysis, but the AC:L/PR:L vector indicates this class of EoP is typically straightforward to weaponize once the root cause is understood.