Windows Installer CVE-2026-85361

Exploitation requires an attacker to already be authenticated on the target as a local low-privileged user (PR:L) and to have local access (AV:L) - there is no remote or network-facing attack surface. The HIGH attack complexity (AC:H) indicates a meaningful limiting factor: the use-after-free almost certainly must be triggered by winning a race condition or forcing a specific allocation/free timing in the Windows Installer (msiexec) service, so exploitation is not reliable on a single attempt. No user interaction is needed (UI:N) and no non-default configuration is called out - the flaw is in the core Installer component present in all supported Windows editions, so the primary practical limits are the need for prior local access and the timing-dependent reliability of the use-after-free.

This is a locally-exploitable elevation-of-privilege flaw (CWE-416 use-after-free) in the Windows Installer service. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms it requires local access and existing low-privileged authentication, with HIGH attack complexity - meaning exploitation depends on winning a race or satisfying specific timing/state conditions rather than a reliable single-shot trigger. The 7.0 base score is driven by total impact (C:H/I:H/A:H), and CISA's SSVC framework corroborates this with Technical Impact: total; however SSVC also reports Exploitation: none and Automatable: no, which strongly tempers urgency. No KEV listing and no POC are present in the input, and no EPSS score was provided, so there is no evidence of in-the-wild or imminent exploitation. Net assessment: a credible local privilege-escalation primitive worth patching in standard Microsoft Patch Tuesday cadence, but NOT an emergency - the HIGH complexity, local-only vector, authentication requirement, and 'Exploitation: none / Automatable: no' signals collectively indicate this is a high-severity-but-not-high-urgency issue rather than an actively dangerous one. One minor data note: the 'Denial Of Service' tag is somewhat inconsistent with the description, which characterizes the flaw as privilege elevation (the A:H impact is the only DoS-adjacent signal).

A local attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) triggers a use-after-free condition in the Windows Installer service to corrupt memory and execute code in a higher-privilege (SYSTEM) context. Because the CVSS vector specifies HIGH attack complexity, success likely hinges on winning a race condition or achieving a precise memory state, so exploitation may require multiple attempts. No public exploit identified at time of analysis.