Windows Installer CVE-2026-87711

Requires the attacker to already possess local, authenticated low-privilege access to the Windows host (CVSS PR:L, AV:L) - there is no remote or unauthenticated path, which is the primary factor limiting real-world risk. Exploitation targets the Windows Installer (msiexec/MSI) component and needs no user interaction (UI:N) and no special non-default configuration, as Windows Installer is enabled by default on all affected Windows client and server versions. Limiting factors: the attacker must first gain an initial foothold on the machine, and unpatched builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2025 <10.0.26100.33650) must be present.

This is a credible, actionable priority despite modest exploitation signals. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local privilege-escalation flaw: an attacker needs local access and low-level (authenticated) privileges, but exploitation is low-complexity, requires no user interaction, and yields full confidentiality, integrity, and availability impact - i.e., SYSTEM-level compromise via the Windows Installer service. The CVSS vector (AV:L) and the description ('elevate privileges locally') are mutually consistent, so there is no network/local conflict to resolve. No EPSS score, CISA KEV listing, or public POC is present in the provided data; by the precision rules this means no public exploit is identified at time of analysis and there is no evidence of active exploitation. The absence of EPSS/KEV should NOT be read as 'safe' - local EoP bugs in Windows Installer are classic second-stage tools used after initial access and are frequently reverse-engineered from patches shortly after Patch Tuesday. Net: high-severity, broadly deployed, local-only - a strong patch priority for endpoint and server fleets, though not an internet-facing emergency since it cannot be triggered remotely or without an existing foothold.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a stolen standard-user credential, or a compromised service account) invokes the vulnerable Windows Installer code path with a crafted input that overflows a stack buffer (CWE-121), overwriting control data to execute code as SYSTEM. No user interaction is required and attack complexity is low. No public exploit code was identified in the provided data, so weaponization would require the attacker to develop or obtain a working exploit.