EUVD-2026-99586
GHSA-hvq2-v92m-g62r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated local access to Windows host
-
DeliveryInvoke crafted Windows Installer operation
-
ExploitTrigger use-after-free and win reclaim race
-
ExecutionExecute attacker-controlled code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold low-privileged authenticated local access to the Windows host (PR:L, AV:L) and to interact with the Windows Installer (msiexec) service to trigger the use-after-free. Key limiting factor: high attack complexity (AC:H) - the attacker must win a non-deterministic race/timing window to reclaim the freed object, so exploitation is not consistently reliable. No user interaction is needed (UI:N), and no special non-default configuration is indicated since Windows Installer is a core OS component; affected builds span Windows 10/11 (through 26H2), and Windows Server 2012 through 2025, below the patched build numbers listed in EUVD. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local privilege-escalation requiring the attacker to already have low-privilege authenticated access to the host, and the high attack complexity (AC:H) reflects the race/timing window typical of use-after-free exploitation. These signals align with CISA's SSVC decision: Exploitation=none and Automatable=no, meaning no observed exploitation and the flaw cannot be reliably mass-automated, while Technical Impact=total matches the C:H/I:H/A:H full-system compromise once exploited. No CISA KEV listing and no POC are present in the input, and no EPSS score was provided, so there is no evidence of in-the-wild use. Net: high technical impact (SYSTEM-level EoP on Windows) but constrained real-world risk because it needs prior local access plus a hard-to-win race condition - a solid patch-in-normal-cycle item rather than an emergency, though the ubiquity of Windows raises aggregate exposure. Note a minor conflict: the input Tags include 'Denial Of Service,' which understates the impact versus the description's privilege elevation and the total technical impact - treat this as an EoP primarily. |
| Exploit ScenarioDerived | A local, low-privileged authenticated user (or malware already running in a limited user context) runs a crafted program that manipulates the Windows Installer service to reference freed memory, then wins a timing race to control the reclaimed allocation. Successful exploitation yields code execution at SYSTEM, giving full control of the host. No public exploit code is identified in the provided data, and the high attack complexity means reliable exploitation is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds low-privileged local access on a Windows host trigger a use-after-free inside the installer service and gain elevated (SYSTEM-level) code execution. Exploitation is constrained by high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0): the attacker must win a non-deterministic race/heap-grooming window to reclaim the freed object, so the technique is not consistently reliable, and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation: none and Automatable: no. Vendor patches are available for the full affected build matrix spanning Windows 10 and Windows 11 (through 26H2) as well as Windows Server 2012 through Windows Server 2025, so this is a genuine but second-tier priority relative to remotely exploitable or actively exploited issues.
RemediationAI
Apply the Microsoft security update for CVE-2026-88124 as documented in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88124); the vendor confirms patches are available, and installing the build at or above the applicable threshold removes the use-after-free condition - 10.0.14393.9612 for Windows 10 1607 / Server 2016, 10.0.17763.9376 for Windows 10 1809 / Server 2019, 10.0.19044.7807 for Windows 10 21H2 and 22H2, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.9711 for Windows 11 24H2, 10.0.26200.9711 for Windows 11 25H2, 10.0.26300.9711 for Windows 11 26H2, 10.0.28000.3231 for Windows 11 26H1, 10.0.20348.5761 for Server 2022, 10.0.26100.33650 for Server 2025, 6.2.9200.26434 for Server 2012, and 6.3.9600.23470 for Server 2012 R2. Because the prerequisite is an existing low-privileged local session, prioritize patching multi-user hosts, RDP/VDI jump boxes and terminal servers where untrusted or semi-trusted users already have interactive logon rights, and treat single-user workstations as normal-cadence remediation given the AC:H race requirement and the absence of known exploit code. There is no clean configuration workaround: the vulnerable code is reachable through the core Windows Installer service, and disabling the msiserver service (or blocking msiexec via AppLocker/WDAC deny rules) does prevent the attack path but also breaks all MSI-based software installation, updates and repair operations, so it is only realistic as a temporary measure on high-value, tightly managed hosts. Practical compensating controls while patching is in progress are to minimize the population of accounts with local interactive logon, remove unnecessary local administrator membership, and monitor for suspicious msiexec child-process behaviour (for example msiexec spawning cmd.exe, powershell.exe or unusual binaries) as detection for post-exploitation staging - noting that these reduce exposure and improve detection but do not eliminate the underlying defect, since authentication requirements remain satisfied by any low-privileged local session. Roll out in line with the vendor's monthly cumulative update process and verify build numbers after installation, as the fix is delivered through the standard Windows servicing channel rather than a standalone installer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Windows Installer (msiexec/msiserver), the core Windows component responsible for interpreting MSI packages, running custom actions and rollback scripts, and performing privileged installation work under the SYSTEM account. A memory object allocated during installer processing is released and subsequently dereferenced, allowing an attacker who can drive the installer's execution path to reclaim the freed allocation with attacker-influenced data and pivot that primitive into arbitrary memory write or control-flow hijack in the installer's elevated security context. Per the assessed vector the attack is local (AV:L) and requires only low privileges (PR:L) with no user interaction (UI:N); the AC:H rating reflects the fact that successful exploitation depends on winning a timing/race window rather than a deterministic bug, and the SSVC assessment of Technical Impact: total but Exploitation: none and Automatable: no is consistent with an unreliable, non-scripted LPE primitive. Because Windows Installer is a built-in OS service present with default configuration on every affected build, there is no non-default configuration prerequisite; the only gate on reachability is the ability to execute an MSI-driven operation from an already-compromised low-privileged session. Affected builds identified by EUVD span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, which confirms the defect lives in shared installer code shipped across both client and server SKUs.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP needing existing low-priv access (AV:L/PR:L), a use-after-free race giving AC:H, no UI, and SYSTEM-level takeover yielding C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Windows Installer contains a high-severity local privilege escalation vulnerability affecting supported Windows 10, Windows 11, and Windows Server 2012-2025 builds, where an attacker with existing low-privileged local access could potentially elevate to SYSTEM. Although exploitation requires a difficult race condition and no public exploit identified at time of analysis, the broad Windows estate means unpatched endpoints and servers could weaken privileged access controls and integrity if an attacker gains an initial local foothold. Leadership should treat this as a second-tier priority behind remotely exploitable or actively exploited threats, but ensure it is covered by routine patch management.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB