Windows Server 2012 EUVD-2026-22449

Local user account required on Windows system with Windows Installer service running. Attack requires ability to create or modify .msi installer packages or intercept installer operations during execution.

Real-world risk is HIGH for multi-user environments and standard deployment scenarios. The CVSS 7.8 score accurately reflects severity: AV:L limits exploitation to local access, but PR:L (low privileges required) means any authenticated standard user can exploit this, AC:L indicates straightforward exploitation without complex timing or race conditions, and S:U with C:H/I:H/A:H shows complete system compromise within the vulnerable context. While EPSS data is not provided, local privilege escalation vulnerabilities in Windows Installer historically attract rapid weaponization due to their utility in post-exploitation phases. The authentication requirement (PR:L) prevents remote exploitation but does not significantly reduce risk in enterprise environments where: (1) users routinely operate with standard accounts, (2) initial access is commonly achieved via phishing or software vulnerabilities, and (3) attackers seek privilege escalation to establish persistence and move laterally. No public exploit identified at time of analysis reduces immediate risk, but the vulnerability's straightforward nature (AC:L) suggests exploit development is trivial for skilled adversaries. Patch availability from Microsoft across all supported versions makes this remediable, elevating priority for organizations following defense-in-depth strategies. The Information Disclosure tag suggests potential data exfiltration vectors beyond pure privilege escalation. Organizations should prioritize patching on multi-user systems, terminal servers, and jump boxes where standard users interact with sensitive resources.

An authenticated local user crafts a malicious .msi package that exploits improper permission validation in Windows Installer, escalating privileges to SYSTEM without requiring administrative credentials or user interaction.