Windows Installer EUVD-2026-100068

Exploitation requires the attacker to already have local, authenticated access to the host with at least low-privilege rights (PR:L, AV:L) - there is no remote or unauthenticated vector. The core prerequisite is winning a race condition in Windows Installer's handling of a shared resource during concurrent execution, which per CVSS AC:H is timing-dependent and not reliably reproducible on a single attempt. No user interaction is required (UI:N). The principal limiting factors are the need for a local account on the target, the probabilistic high-complexity race window that may demand many attempts, and reduced exposure on single-user systems where an attacker gaining SYSTEM adds little beyond existing control.

This is a moderate-severity local privilege escalation (CVSS 7.0) in Windows Installer driven by a race condition (CWE-362). The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) tells a consistent story: the attacker must already be local and authenticated (PR:L), and high attack complexity (AC:H) reflects the timing-dependent nature of winning the race, which is the single biggest factor limiting real-world weaponization. If the race is won, impact is full (C:H/I:H/A:H), consistent with SYSTEM-level escalation. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of these exploitation signals, combined with AC:H, places this below internet-facing or wormable flaws in priority: it is a credible post-compromise/local-escalation primitive rather than an initial-access emergency. Treat it as standard Patch-Tuesday-tier remediation for an EoP - important on multi-user and shared hosts, lower urgency on single-user endpoints - rather than a drop-everything issue. Note: the input 'Information Disclosure' tag only partially aligns with a race-condition EoP; the C:H confidentiality impact makes it defensible but the primary consequence per the description is privilege elevation, not disclosure.

A low-privileged but authenticated user on a Windows host runs a local tool that repeatedly triggers Windows Installer operations while racing a concurrent action against a shared resource, aiming to win a narrow timing window. Because attack complexity is high (AC:H), success is probabilistic and may require many attempts, but a win yields SYSTEM-level privileges. No public exploit code was identified in the provided data.