Windows Installer CVE-2026-87694

Exploitation requires the attacker to already hold a local, authenticated low-privilege session on the target Windows host (PR:L, AV:L) and to invoke Windows Installer (MSI/msiexec) operations that drive the vulnerable use-after-free code path; no user interaction and no non-default configuration are needed (UI:N, AC:L), and it affects default installations since Windows Installer is a core OS component. The principal limiting factor is that this is NOT remotely exploitable - an attacker must first obtain local code execution or an interactive foothold, making it a post-compromise privilege-escalation step rather than an initial-access vulnerability.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in Windows Installer, driven by a use-after-free (CWE-416). All CVSS signals are internally consistent: local attack vector, low complexity, low privileges already required, no user interaction, and full high impact to confidentiality, integrity, and availability on the local system. The vulnerability requires an attacker to already have authenticated (low-privilege) access to the host - it is not a remote entry point but a privilege-escalation primitive used after initial foothold, which is the pattern that makes it attractive in post-exploitation and ransomware chains. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is NO evidence of active exploitation or public exploit code at this time; treat exploitation status as 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data means real-world exploitation probability cannot be quantified from the provided signals - this is not a confirmed in-the-wild threat, but the combination of ubiquitous product footprint, low exploitation prerequisites, and Microsoft's own reporting makes it a credible patch-priority item for any multi-user or endpoint environment rather than a high-CVSS-but-low-real-risk theoretical issue.

An attacker who has already gained low-privileged authenticated code execution on a Windows host (e.g. via phishing or a compromised standard user account) invokes Windows Installer operations crafted to trigger the use-after-free, corrupting memory to run attacker-controlled code with SYSTEM privileges. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, the attack is local, low-complexity, needs no victim interaction, and only requires an existing unprivileged session. No public proof-of-concept was identified in the provided data.