Windows Installer CVE-2026-87700

Exploitation requires the attacker to already have authenticated, low-privileged code-execution on the target Windows host (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not a remotely reachable flaw, so it cannot be triggered across the network and there is no pre-authentication exposure. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once local access exists, triggering the use-after-free in the Windows Installer service is reliable against default configurations of all listed Windows client and server builds below the patched versions (e.g. Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650). The principal limiting factor is the need for an existing foothold; it is realistically a second-stage escalation step rather than an initial-access vector.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local elevation-of-privilege flaw: the attacker must already have authenticated low-privilege code execution on the host (PR:L), but no user interaction is needed (UI:N) and complexity is low (AC:L), with full confidentiality, integrity and availability impact on the local system. Exploitation status is 'no public exploit identified at time of analysis' - the input provides no EPSS score, no CISA KEV listing, and no POC flag, so there is no evidence of active exploitation or weaponization. The signals are internally consistent: a memory-corruption EoP in a core OS component reported by the vendor (secure@microsoft.com) with a patch already available, which is the normal Patch-Tuesday-class profile. MISSING DATA to note explicitly: EPSS probability is absent (cannot gauge statistical exploitation likelihood), KEV status is not confirmed either way, and no SSVC decision data is provided. Net: treat as a standard high-severity local EoP - patch on normal prioritized cadence; it becomes a chaining risk when combined with a remote-code-execution or initial-access bug, since UAF EoPs are classic second-stage primitives for SYSTEM escalation.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload, a compromised service account, or a prior remote exploit - invokes the Windows Installer service in a way that triggers the use-after-free condition. By grooming the freed object and reclaiming it with attacker-controlled data, they corrupt memory to execute code in the privileged installer context and elevate to SYSTEM. No public proof-of-concept exploit is identified in the provided data.