Windows Installer EUVD-2026-43876

Exploitation requires the attacker to already have low-privileged authenticated local code execution on the target (CVSS PR:L, AV:L) - this is a second-stage privilege escalation, not a remote entry point. The exact triggering feature is the Microsoft Install Service (Windows Installer) mishandling privileges during its operations; no user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists the escalation to SYSTEM is straightforward. The primary limiting factor is the local-access prerequisite: an attacker with no presence on the machine cannot exploit this remotely, and hardening that prevents initial low-priv code execution correspondingly blocks the chain. Applies to default configurations of the affected Windows 10/11 and Windows Server 2019-2025 builds enumerated in the CPE data.

The CVSS 3.1 base score of 7.8 (High) reflects a local, low-complexity attack requiring only low privileges and no user interaction, with high impact to all three security properties - the canonical profile of a SYSTEM-level LPE. Attack vector AV:L means the attacker must already have code execution on the host, which lowers drive-by risk but makes this valuable as a second-stage escalation after initial access (phishing, malware, or a compromised low-priv account). No EPSS score was provided in the input, KEV status is not confirmed (not actively exploited per available data), and no POC is referenced, so this is a real but not emergency-tier priority: patch on the normal Patch Tuesday cadence, prioritizing multi-user and high-value hosts. All signals are internally consistent (local vector matches the privilege-management root cause); no conflicting data was observed.

An attacker who has already gained a foothold as a low-privileged local user - for example via a phishing payload or a compromised service account - invokes the vulnerable Microsoft Install Service to abuse its improper privilege handling and obtain SYSTEM-level execution. With low attack complexity and no user interaction required, the escalation is reliable once local code execution exists, giving the attacker full control of the host. No public exploit is identified at time of analysis, but the LPE profile makes it an attractive post-exploitation building block.