Windows EUVD-2025-17788

CVSS vector analysis (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high real-world risk: Local attack vector with Low complexity means any authorized user can exploit this reliably without special conditions; Low privileges required confirms standard user accounts suffice; No user interaction required means automated exploitation is feasible. The confidentiality, integrity, and availability impacts are all high (complete system compromise). Without EPSS score data, KEV status confirmation, or POC availability provided, the intrinsic CVSS vector strongly suggests this is NOT a low-risk high-CVSS issue—the combination of low attack complexity, low privilege requirements, and no user interaction requirement indicates this is actively exploitable by malware, insider threats, and standard privilege escalation payloads. Organizations with multi-user systems or where local user accounts have network access should treat this as a priority. Likelihood of exploitation is HIGH given the ease of initial access (any local user) and complete impact potential.

An attacker with a standard local user account (e.g., employee, guest account, or account compromised via phishing) exploits this vulnerability by triggering a maliciously crafted MSI package or manipulating an existing installer operation through improper access control. Since UI interaction is not required and privilege requirement is low, the attacker can automate exploitation—for example, by placing a malicious MSI in a world-writable directory and invoking msiexec.exe with specific parameters, or by hijacking an existing system installer process. The MSI runtime fails to properly validate the caller's authorization, allowing SYSTEM-level code execution. The attacker gains SYSTEM privileges without elevation prompts or user awareness, enabling malware installation, credential theft, lateral movement, or persistent backdoor establishment. In enterprise environments with shared systems, this allows any standard user to fully compromise the system, making it a critical privilege escalation vector for post-compromise activity.