Windows Installer CVE-2026-87693

Exploitation requires local access with an existing low-privilege authorized account on the target (CVSS PR:L, AV:L) - this is not remotely reachable and cannot be triggered across the network. The attacker must interact with the Windows Installer service to trigger the use-after-free; no victim user interaction is required (UI:N). The key limiting factor is HIGH attack complexity (AC:H): the use-after-free likely depends on winning a race condition or achieving specific heap/object-lifetime timing, so exploitation is not guaranteed on a single attempt. Affected systems are unpatched builds across Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025; applying the vendor update removes the condition.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) describes a local attack that already requires a foothold (PR:L - an authenticated/authorized user) and carries HIGH attack complexity, consistent with a use-after-free (CWE-416) that likely depends on winning a race condition or precise heap timing against the Windows Installer service. The high-complexity requirement meaningfully dampens real-world risk versus a trivial 'drop-and-run' EoP. All exploitation signals point low: CISA SSVC lists Exploitation=none (no observed or public exploitation) and Automatable=no, which aligns with the AC:H rating; no KEV listing and no POC are present in the input, so there is no public exploit identified at time of analysis. The counterweight is SSVC Technical Impact=total and the C:H/I:H/A:H triad, meaning a successful exploit yields full SYSTEM-level compromise of the host - this is why it is not dismissible despite low exploitation probability. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: a genuine-but-not-urgent patch item - high impact if exploited, but gated behind local access and high complexity with no evidence of active exploitation.

A local attacker who already has standard-user access (e.g., via phishing, a compromised low-privilege account, or malware foothold) runs code that triggers a use-after-free in the Windows Installer (msiexec) service, repeatedly racing the flaw to corrupt memory and hijack execution in a SYSTEM-level context. Because attack complexity is HIGH, the attacker likely must win a race or groom the heap across multiple attempts. No public exploit code is identified at time of analysis.