Windows Installer CVE-2026-87715

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-level user privileges (PR:L) - this is not remotely reachable (AV:L) and needs no victim interaction (UI:N). The use-after-free must be triggered through a Windows Installer (MSI) operation, and the High attack complexity (AC:H) indicates a non-trivial limiting condition such as winning a race window or achieving a specific heap state before the freed object is reused, which reduces reliability and may require repeated attempts. Affected scope spans Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025, so exploitation is limited to builds below the patched versions listed in EUVD-2026-100079; patched builds are not vulnerable.

This is a moderate-priority, NOT an emergency-patch item. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a use-after-free (CWE-416) in Windows Installer that requires LOCAL access, LOW but existing privileges (PR:L, so the attacker must already be an authenticated user on the box), and HIGH attack complexity (AC:H) - meaning the attacker must win a race or satisfy specific heap/timing conditions to reliably trigger the free-then-reuse. Against that, the impact is full compromise once achieved (C:H/I:H/A:H), consistent with an elevation-of-privilege-to-SYSTEM outcome typical of Windows Installer flaws. On the threat side the signals are quiet and consistent: no CISA KEV listing, no public POC identified, and no EPSS score was supplied, so there is no evidence of active or imminent mass exploitation. No signals conflict here - a local, high-complexity, privilege-required EoP with a vendor patch available but no exploitation evidence is a routine 'patch in normal cycle' item rather than a drop-everything priority. The main caveat is missing data: EPSS and any SSVC/automatable determination were not provided, so exploitation probability is inferred from the absence of KEV/POC rather than measured.

A local, already-authenticated low-privileged user (or malware running in a standard user context) invokes or races a Windows Installer operation to trigger the use-after-free, reusing freed memory to corrupt an object and redirect execution into attacker-controlled data, gaining SYSTEM-level privileges. Because attack complexity is High, the attacker likely needs to win a timing/race window and may require multiple attempts. No public exploit code has been identified at time of analysis.