Windows Installer CVE-2026-87704

Exploitation requires pre-existing LOCAL access with at least low-privilege credentials (CVSS AV:L, PR:L) - this is not remotely reachable and cannot be triggered by an unauthenticated network attacker. No user interaction is needed (UI:N). The key LIMITING factor is the high attack complexity (AC:H): as a use-after-free (CWE-416) in Windows Installer, the attacker must win a race or achieve a specific heap/memory-reuse state to reliably control the freed object, making exploitation timing-dependent rather than deterministic. Exploitation targets the Windows Installer (msiexec) service present by default on all supported Windows versions, so no non-default configuration is required, but the attacker must already be able to execute code locally on the host.

This is a locally-exploitable use-after-free elevation-of-privilege flaw in Windows Installer. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 / High) signals meaningful real-world constraints that temper the full C/I/A impact: the attacker must already have local access and valid low-level credentials (PR:L), and exploitation is rated high-complexity (AC:H), which for a use-after-free typically reflects a memory-reuse race or heap-grooming requirement that is not deterministic. No EPSS score, KEV listing, or POC reference was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is therefore a credible but not emergency-tier issue: it is a post-compromise privilege-escalation primitive (attacker needs a foothold first) rather than a remotely-wormable bug, and the AC:H rating argues against reliable mass exploitation. The one signal that raises its practical priority is prevalence - it affects the entire supported Windows ecosystem - so despite the moderate score it warrants timely patching as part of standard Patch Tuesday remediation. Note the 'Denial Of Service' tag sits oddly against a description that specifies privilege elevation; the A:H metric plausibly covers a DoS side effect, but the primary impact per the description and CWE-416 is EoP - treat the DoS framing with caution.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised service) invokes or races a Windows Installer operation to trigger the use-after-free, reusing freed memory to corrupt an object and redirect execution into attacker-controlled data. Successful exploitation elevates them from a limited account to SYSTEM. No public exploit code was identified in the provided data, and the CVSS AC:H rating indicates the required timing/heap conditions make reliable exploitation non-trivial.