Windows Installer CVE-2026-85358

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (CVSS AV:L, PR:L) and the ability to invoke a Windows Installer operation that reaches the vulnerable heap-allocation code path; no user interaction is needed (UI:N). The key limiting factors are that the attack cannot be performed remotely and demands a pre-existing foothold on the machine, and that fully patched builds (e.g., Windows 11 24H2 ≥10.0.26100.9711, Server 2022 ≥10.0.20348.5761, Server 2025 ≥10.0.26100.33650) are not vulnerable. No special non-default feature toggle is implied by the description - the Windows Installer service is present by default on all affected editions.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows Installer service. The CVSS vector and the description agree cleanly: local attack vector, low complexity, and an already-authorized (low-privileged) attacker needing no user interaction, yielding total confidentiality, integrity, and availability impact - consistent with CISA SSVC rating Technical Impact 'total'. However, the exploitation signals are notably cool: SSVC Exploitation is 'none', there is no CISA KEV listing, and no public exploit code was provided, so the status is 'no public exploit identified at time of analysis'. SSVC Automatable 'no' is expected for a local EoP that requires an existing foothold and cannot be mass-scanned/wormed. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: this is a genuine, high-severity post-compromise privilege-escalation primitive affecting the entire Windows fleet, but not an emergency 'exploit-now' internet-facing issue - it requires an attacker to already have local code execution as a low-privileged user. Prioritize it in normal patch cycles with elevated urgency on multi-user/shared and high-value hosts; it is high-severity-and-high-prevalence but currently low on real-world exploitation signal.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing or a compromised service account) invokes a crafted Windows Installer operation that overflows a heap buffer, corrupting memory in the privileged installer context. No public exploit code was identified at the time of analysis, but successful exploitation elevates the attacker to SYSTEM, granting full control of the machine.