Windows Installer CVE-2026-87708

Exploitation requires the attacker to already have authenticated local access to the target host with at least low-level privileges (PR:L, AV:L) - there is no remote or network path. The core limiting factor is the high attack complexity (AC:H): as a use-after-free, the attacker must reliably win a race/timing window to reallocate and control the freed Windows Installer object, which is non-deterministic and resists automation (SSVC Automatable=no). No user interaction is needed (UI:N). The flaw affects the default Windows Installer service present in all listed Windows 10/11 and Windows Server 2012-2025 builds below the patched versions, so no special non-default feature must be enabled; the practical barrier is privilege prerequisite plus exploitation reliability, not configuration.

This is a genuine but not top-tier priority. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local privilege-escalation flaw: the attacker must already have local, low-privileged access (PR:L) and overcome high attack complexity (AC:H), which for a use-after-free (CWE-416) typically means winning a timing/race window to reclaim freed memory. All exploitation signals point AWAY from mass exploitation: SSVC records Exploitation=none, Automatable=no (consistent with the AC:H race condition), and there is no CISA KEV listing and no public POC identified. Technical Impact is rated 'total' by SSVC, matching the C:H/I:H/A:H impact - successful exploitation yields full SYSTEM-level compromise of the host. The signals are internally consistent rather than conflicting: a high-impact-but-hard-to-exploit local EoP. The practical risk is that this is a reliable post-compromise escalation primitive (useful after phishing/initial access) rather than an initial-access or wormable threat. Note one metadata tension: the input Tags include 'Denial Of Service' while the description and vector describe privilege elevation with full CIA impact - the DoS label likely reflects the A:H availability impact rather than a distinct DoS-only behavior, but it was not independently confirmed.

An attacker who has already gained an unprivileged foothold on a Windows host (e.g., via phishing or a compromised low-privilege account) runs a crafted program that abuses the Windows Installer service to trigger a use-after-free, winning a race condition to control the freed object and execute code as SYSTEM. No public exploit code is identified, and the high attack complexity (AC:H) makes reliable exploitation non-trivial, so this is most plausible as a second-stage escalation step rather than an opportunistic attack.