Windows Installer EUVD-2026-100071

Requires an existing authenticated low-privileged local session on the target host (AV:L, PR:L, no user interaction) interacting with the Windows Installer service; it cannot be triggered remotely or by an anonymous user. Exploitation is further limited by high attack complexity (AC:H), meaning the attacker must satisfy specific conditions - likely a race or particular Installer runtime state - to turn the NULL pointer dereference into a usable privilege-escalation primitive rather than a mere crash. Affected hosts are any unpatched Windows build within the EUVD-listed ranges (Windows 10 21H2/22H2, Windows 11 23H2-26H2, Server 2012 through Server 2025).

This is a locally-exploitable privilege-escalation flaw (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows Installer service. The vector signals a genuine but not trivial threat: the attacker must already have local, authenticated access with low privileges (PR:L) and must overcome high attack complexity (AC:H), which typically implies winning a race condition or meeting specific runtime state to force the NULL pointer dereference into an exploitable EoP primitive rather than a simple crash. Impact is rated full C:H/I:H/A:H, consistent with gaining SYSTEM. No EPSS score, SSVC decision, KEV listing, or POC is present in the provided data, so there is no evidence of active or probable near-term exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' There is a notable conflict in the metadata: the CWE (CWE-476, NULL pointer dereference) and the 'Denial Of Service' tag both point toward a crash/DoS outcome, yet the official description explicitly says the flaw is used to 'elevate privileges locally' and the CVSS impact triad is C:H/I:H/A:H - a pure DoS would normally be A:H with C:N/I:N. Treat this as an EoP primitive, not a DoS, and note the tag/CWE framing understates the real impact. Overall this is a patch-in-normal-cycle local EoP: meaningful on multi-user and post-compromise hosts, but gated by prior local access and high complexity, so not an emergency relative to remote unauthenticated criticals.

An attacker who already has a low-privileged authenticated foothold on a Windows host (for example via phishing, stolen credentials, or a sandboxed service account) invokes Windows Installer in a way that triggers the NULL pointer dereference under the specific conditions required by AC:H, converting the fault into a controlled privilege-escalation primitive to run code as SYSTEM. No public exploit code is identified in the provided data, and the high attack complexity suggests reliable exploitation requires precise timing or state manipulation.