Windows Installer CVE-2026-96302

Requires LOCAL access with an existing low-privileged authenticated account (PR:L, AV:L) on a host running the Windows Installer (msiexec) service, which is present by default on all supported Windows client and server editions - no special feature flag or non-default configuration is called out in the advisory. Exploitation hinges on triggering and winning a use-after-free race condition (reflected in AC:H), so success is timing-dependent and not guaranteed on a single attempt. Limiting factors: no remote vector (local only), the attacker must already be authenticated on the system, no user interaction of a victim is required (UI:N) but a prior foothold is, and high attack complexity reduces reliability. Server Core installations are also affected per the EUVD version list.

Signals are consistent and point to a moderate, non-urgent priority. The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N - local vector, high attack complexity, and low privileges already required - which caps real-world urgency despite the 'total' technical impact (C:H/I:H/A:H). CISA SSVC reinforces this: Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass-automation path (consistent with a race-condition use-after-free that is fingerprintable but not trivially weaponizable). The vulnerability is NOT in CISA KEV and no public exploit code was identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The AC:H metric aligns with a CWE-416 use-after-free that likely depends on winning a timing/race window, which also explains Automatable=no. Net: this is a legitimate local elevation-of-privilege flaw worth patching in normal cycles, but not an emergency - the combination of required local authenticated access, high complexity, no automation, and no known exploitation keeps real-world risk well below what the 7.0 'High' label alone might suggest. The one minor conflict is the 'Denial Of Service' input tag versus a description that states only privilege elevation; the A:H impact partially supports an availability effect, but the primary consequence is EoP, not DoS.

A local, low-privileged attacker who has already gained a foothold on a Windows host (e.g., a standard user account or a constrained service account) interacts with the Windows Installer service to trigger a use-after-free, winning a race condition to reclaim the freed object with attacker-controlled data. Successful exploitation yields code execution at SYSTEM, giving full control of the machine. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.