Windows Installer CVE-2026-77894

Exploitation requires an authenticated local user account with standard (low) privileges - no administrative rights are needed. The attacker must have the ability to execute code locally on the target system, via interactive logon, Remote Desktop Protocol (RDP), or code execution obtained through a prior vulnerability. The race condition must be triggered during an active Windows Installer operation (installation, repair, or removal); the attacker may need to initiate, wait for, or cause a qualifying installer event. High attack complexity (AC:H) means reliable exploitation requires precise timing and is unlikely to succeed on every attempt, potentially requiring automated retry loops. Exploitation is strictly limited to local access - network-only access without a local execution foothold cannot trigger this vulnerability.

The CVSS 7.0 score accurately reflects meaningful exploitation constraints: AV:L limits the attack surface to local code execution, and AC:H acknowledges that race conditions are timing-dependent and may require repeated attempts or specific system load conditions to land reliably. PR:L confirms that a standard low-privileged user account is the minimum prerequisite - no administrative rights are needed. With no public exploit code and no CISA KEV listing, exploitation is unconfirmed at time of analysis; however, Windows Installer LPE race conditions are a well-documented attack class, and analogous TOCTOU patterns in msiexec have been publicly demonstrated in prior CVEs, making this attack class technically accessible to skilled threat actors. EPSS data was not provided in the source intelligence, but the combination of AC:H and no known active exploitation suggests a moderate-low probability for opportunistic attackers and a higher probability in targeted post-breach scenarios where local foothold already exists. The broad version coverage - from EOL Server 2012 through current Server 2025 - expands the realistic attack surface considerably, particularly in environments with deferred patching. Organizations that restrict interactive local logon and RDP to only high-trust accounts substantially reduce the exploitable population.

An attacker with a low-privileged local shell - obtained via phishing, credential theft, or lateral movement from another compromised host - monitors for or triggers a Windows Installer repair or installation operation, then races to substitute a directory junction or symbolic link within the SYSTEM-context file operation window so that msiexec writes attacker-controlled content (such as a malicious DLL) to a privileged system path, resulting in code execution as SYSTEM. No public proof-of-concept has been identified for this specific CVE, but prior msiexec TOCTOU exploits demonstrate the technical feasibility of this attack pattern for skilled attackers.