Windows Installer CVE-2026-96305

Requires the attacker to already hold authenticated, low-privileged access to the target host and the ability to execute code locally (AV:L/PR:L) - this is not remotely exploitable. Exploitation hinges on triggering the vulnerable use-after-free in the Windows Installer (msiexec) service, which per the high attack complexity (AC:H) almost certainly involves winning a memory-reuse timing race, so success is non-deterministic and may require repeated attempts. No user interaction is required (UI:N). Limiting factors: the need for a prior local foothold, the race-condition reliability barrier, and the availability of a vendor patch across all supported Windows 10/11 and Server builds listed in the EUVD ranges.

This is a locally-exploitable elevation-of-privilege flaw (CVSS:3.1 AV:L/AC:H/PR:L/UI:N, base 7.0) in the Windows Installer service, where a use-after-free (CWE-416) yields full confidentiality, integrity and availability impact (C:H/I:H/A:H) on the local system. The attacker already needs authenticated low-privilege access (PR:L) and local access (AV:L), and the high attack complexity (AC:H) implies a race condition or non-deterministic heap state that must be won, which meaningfully dampens reliability and mass-exploitation potential. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; EPSS was not supplied in the input, so exploitation-probability cannot be quantified here. No SSVC decision data was provided. Net assessment: a genuine local privilege-escalation primitive valuable as the second stage of an attack chain (post-initial-access), but not an internet-facing emergency - the AC:H and PR:L requirements plus absence of KEV/POC place it as a patch-on-normal-cycle priority rather than a drop-everything item, with the caveat that Windows Installer EoP bugs are historically attractive to post-exploitation tooling once a reliable technique emerges.

An attacker who has already gained an unprivileged foothold on a Windows host (e.g., via phishing or a low-privileged service account) triggers Windows Installer operations in a specific order to free and then reuse a memory object, winning a timing race to corrupt the heap and hijack execution as SYSTEM. No public proof-of-concept is identified at time of analysis, and the high attack complexity means the attacker may need multiple attempts to reliably win the race.