Windows Installer CVE-2026-83672

Exploitation requires the attacker to already have local, interactive, authenticated access to the Windows host as at least a low-privileged user (PR:L, AV:L) - it is NOT remotely reachable and requires no victim interaction (UI:N). The high attack complexity (AC:H) indicates a condition outside the attacker's direct control must be met, such as a race or timing-dependent state in the Windows Installer service, meaning exploitation is not deterministic on demand. Impact is limited to disclosure of sensitive system information (C:H) with no integrity or availability effect; there is no privilege escalation or scope change (S:U). The limiting factors - mandatory prior local authentication, local-only vector, and high complexity - substantially constrain real-world risk relative to the raw score.

This is a genuinely low-to-moderate priority issue, and the available signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7) describes a local, high-complexity attack requiring an already-authenticated low-privileged user, yielding confidentiality impact only (no integrity or availability loss). CISA's SSVC decision points reinforce this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=partial. There is no CISA KEV listing and no POC reported, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here - this is a data gap, not a low score. The one nuance worth flagging: the description phrases this as 'an authorized attacker' disclosing information 'locally,' which matches AV:L and PR:L (a local, already-authenticated user), but the specific class of sensitive information disclosed is not detailed by Microsoft's summary, so the real-world value of what leaks cannot be independently judged from available data. Overall this behaves like a defense-in-depth local information-disclosure fix rather than a widely-exploitable priority - patch in normal cycle, not emergency.

A low-privileged but authenticated local user on a Windows host runs a crafted interaction with the Windows Installer service and, through a race or timing-sensitive condition (reflected in the high attack complexity), reads sensitive system information that should be outside their control sphere. No public exploit code or active exploitation has been reported, and the high complexity plus local-only vector make reliable, repeatable exploitation nontrivial.