EUVD-2026-100033
GHSA-pc2c-mmrx-v998
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated low-priv access
-
ExploitTrigger Windows Installer operation repeatedly
-
ExecutionWin TOCTOU race window
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have an authenticated, low-privileged local account on the target Windows host (PR:L, AV:L) and must win a race condition (CWE-362, reflected in AC:H) during a Windows Installer operation - a time-of-check/time-of-use window that is non-deterministic and typically requires repeated attempts. No user interaction is needed (UI:N) and no non-default configuration is indicated; the limiting factors are the requirement for prior local access and the unreliable timing-dependent race, which together prevent remote or unauthenticated exploitation. Patched builds per edition are listed in EUVD (e.g., Windows 11 24H2 fixed at 10.0.26100.9711, Server 2025 at 10.0.26100.33650). |
| Impact | Signals point to a moderate, non-urgent local privilege-escalation issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) requires an attacker to already have authenticated low-privileged local access to the host and to win a timing-sensitive condition (AC:H), which materially lowers reliability and rules out remote or unauthenticated use. Impact is severe when successful - C:H/I:H/A:H, consistent with SSVC 'Technical Impact: total' (full SYSTEM-level compromise). However, SSVC also records 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing and no public exploit in the provided data, so this is no public exploit identified at time of analysis. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. Note a minor data tension: the description and CWE-362 (race condition) plus C/I/A=High indicate a privilege-elevation flaw, while a 'Information Disclosure' tag is attached - treat the primary effect as EoP, not disclosure. Net: a genuinely high-impact-if-exploited bug but gated behind local access and a hard-to-win race, making it a patch-on-normal-cycle priority rather than a drop-everything item, barring new exploit activity. |
| Exploit ScenarioDerived | A low-privileged but authenticated user already present on a Windows host (e.g., via a standard account, foothold, or malware) repeatedly triggers a Windows Installer operation to hit a narrow time-of-check/time-of-use race window. By winning that race they cause the Installer to perform a privileged action under their control, elevating to SYSTEM. No public proof-of-concept or active exploitation is known from the provided data, and the high attack complexity (AC:H) means the race must be won reliably, typically requiring many attempts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds a low-privileged local account on a Windows host elevate to SYSTEM-level privileges by winning a race condition during an installer operation. Per the assessed vector (AV:L/AC:H/PR:L/UI:N) the attacker must be authenticated locally and must win a non-deterministic time-of-check/time-of-use window, which typically requires repeated attempts, so exploitation is unreliable and cannot be performed remotely or unauthenticated. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework records exploitation as 'none', making this a moderate, non-urgent local privilege-escalation issue rather than an emergency; vendor patches are available for all listed Windows editions and builds.
RemediationAI
Apply the Microsoft vendor patch for the applicable edition, matching or exceeding the fixed builds published for this CVE: Windows 11 23H2 at 10.0.22631.7652, 24H2 at 10.0.26100.9711, 25H2 at 10.0.26200.9711, 26H1 at 10.0.28000.3231 and 26H2 at 10.0.26300.9711; Windows Server 2025 (including Server Core) at 10.0.26100.33650; Windows Server 2022 at 10.0.20348.5761; Windows Server 2019 and Windows 10 1809 at 10.0.17763.9376; Windows Server 2016 and Windows 10 1607 at 10.0.14393.9612; Windows Server 2012 R2 at 6.3.9600.23470; Windows Server 2012 at 6.2.9200.26434; Windows 10 21H2 and 22H2 at 10.0.19044.7807. Patch status is vendor-released; refer to the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83899 for the exact KB per build and install via Windows Update, WSUS, or your standard patch-orchestration pipeline, prioritizing multi-user and administrative workstations where local standard users are common. Because exploitation requires a pre-existing low-privileged local account plus a race that is timing-dependent, no public exploit code is identified and SSVC records exploitation as 'none', so a routine rather than emergency patch cycle is proportionate. Until patched builds are deployed, reduce exposure by minimizing the number of local interactive accounts on high-value hosts, removing unnecessary local administrator or install rights, and applying application-control or WDAC policy that restricts which binaries may invoke privileged installer operations - noting that overly broad MSI blocklisting can break legitimate software deployment and servicing, so scope any such rule narrowly and test before rollout. Monitoring for unusual msiexec child-process spawning from non-administrative contexts can provide compensating detection while the fleet is remediated; there is no documented configuration toggle that removes the vulnerable code path, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Windows Installer, the msiexec-driven servicing engine that handles MSI/MSIX package installation, repair and rollback on Windows client and server editions. The root cause class is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition), combined in the vendor description with improper privilege management: the installer performs a privileged operation on a resource whose state or path can be altered between the check and the use (TOCTOU). Because the vulnerable code path is executed by a high-privilege installer service, an attacker who controls a low-privileged local process can interleave operations at the right moment and obtain the elevated action for their own payload. The assessed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that the timing requirement is the main practical barrier (AC:H) while confidentiality, integrity and availability impact on the affected host are all high once the race is won; scope is unchanged (S:U). CPE/version data place the flaw across the entire modern Windows install base, spanning Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - indicating a long-lived shared installer code path rather than a single-edition regression. Microsoft's own tagging of the issue includes information-disclosure and race-condition markers, consistent with a synchronization defect exploited for elevation rather than a memory-corruption primitive; there is no indication of network attack surface or of pre-authentication reachability.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated access (AV:L/PR:L), a timing-dependent race raises complexity (AC:H), no UI, and successful elevation yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege-escalation flaw in Microsoft Windows Installer (msiexec) affects the listed supported Windows editions and builds, letting someone who already holds a low-privileged account on a Windows host attempt to elevate to SYSTEM-level privileges. The attack is authenticated/local only and depends on winning a non-deterministic race condition, so it is unreliable and cannot be launched remotely or anonymously. Leadership should care because any endpoint already compromised by commodity malware, a phishing payload, or a contractor's workstation could become a deeper foothold, extending attacker dwell time and widening the blast radius of an initial breach.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB