What is the CVSS score of EUVD-2026-43863?

EUVD-2026-43863 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows App Installer are affected by EUVD-2026-43863?

Windows App Installer, deployed across Windows 10, Windows 11, and Windows Server systems, contains a local privilege escalation vulnerability requiring authenticated access that currently has no…. A patch is available.

How to fix or mitigate EUVD-2026-43863?

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server systems to assess exposure scope and identify highest-priority assets for patching. Within 7 days, deploy Microsoft's released security patch for CVE-2026-50400 to all critical systems, production servers, and endpoints with elevated access or sensitive data responsibilities. Within 30 days, complete patch deployment across all affected Windows systems and confirm successful remediation through your patch management system's compliance reporting.

Windows App Installer EUVD-2026-43863

| CVE-2026-50400 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-14 microsoft

GHSA-q2jw-79qw-q59g

Buffer Overflow Microsoft Stack Overflow Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local EoP requiring an existing low-privileged account (AV:L, PR:L), no victim interaction (UI:N), and a memory-corruption overflow yielding full code execution and thus high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:37 vuln.today

CVE Published

Jul 14, 2026 - 17:06 nvd

HIGH 7.8

DescriptionCVE.org

Stack-based buffer overflow in Windows App Installer allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows App Installer (the MSIX/AppX package deployment component, msixbundle/App Installer) lets an already-authenticated low-privileged user overflow a stack buffer to gain higher privileges on affected Windows 10, Windows 11, and Windows Server builds. Microsoft self-reported the flaw and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (AV:L/PR:L) rating reflects a locally-launched attack with high confidentiality, integrity, and availability impact.

Technical ContextAI

Windows App Installer is the built-in Microsoft component responsible for installing, updating, and provisioning MSIX/AppX application packages (the App Installer app, appinstaller protocol handler, and associated deployment service). The root cause is CWE-121, a stack-based buffer overflow: input processed during package/installer handling is copied into a fixed-size stack buffer without adequate bounds checking, allowing an attacker to corrupt the stack (return addresses, saved registers, or adjacent locals) and redirect execution or corrupt state. Because App Installer routinely runs deployment logic with elevated rights, controlling this overflow translates memory corruption into privilege elevation. The CPE set identifies the affected code across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations.

RemediationAI

Apply the Microsoft security update for CVE-2026-50400; a vendor patch is available (Patch available per vendor advisory) via the standard cumulative/monthly update channel - consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50400 for the exact fixed build numbers per OS version, as the input does not provide a single fix version string. Because App Installer is serviced through Windows Update and the Microsoft Store, ensure both OS updates and App Installer package updates are current, and reboot to complete servicing. Where immediate patching is not possible, reduce exposure of the local attack surface by restricting who can log on interactively to the host, limiting untrusted local/standard users on shared and RDP/terminal servers, and constraining use of the App Installer / appinstaller protocol handler and sideloaded MSIX packages (e.g., enforce that only signed packages from trusted sources are installed); note these controls degrade self-service app installation workflows and do not remove the underlying flaw, so treat them as temporary.