Windows App Installer EUVD-2026-43973

The attacker must have valid low-privileged local access to the machine (PR:L, AV:L - no remote or network exploitation, no user interaction). Exploitation requires triggering an App Installer / MSIX package-handling operation and winning a timing race against the installer's non-atomic check-then-use of a shared resource, which is why the CVSS marks high attack complexity (AC:H): success is non-deterministic and may require many attempts. Limiting factors that reduce realistic risk are the local-access prerequisite, the need for existing authenticated foothold, and the difficulty of reliably winning the race; the flaw is most exploitable on multi-user systems (terminal servers, shared workstations) where a low-privileged attacker already has interactive access.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) tells a nuanced story: the attacker must already have local access with low privileges (PR:L), and exploitation is genuinely hard (AC:H) because it depends on winning a non-deterministic timing race - but if won, impact is full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) via privilege elevation. No EPSS score, KEV entry, or POC was provided, so real-world exploitation pressure is currently low: this is not confirmed actively exploited and no public exploit is identified. The high AC combined with local-only vector makes reliable weaponization difficult, so this ranks as a moderate-priority patch - meaningful for multi-user, terminal-server, and shared-workstation environments, but not an emergency for single-user endpoints. Note a data conflict: the Tags label this 'Information Disclosure', while the Description explicitly says privilege elevation and the CVSS shows full I:H/A:H impact, so the elevation-of-privilege framing (consistent with CWE-362 and the vector) should be treated as authoritative - verify the exact impact via the MSRC advisory.

A low-privileged user on a shared Windows 11 or Windows Server 2025 host runs a small tool that repeatedly triggers an App Installer operation while concurrently swapping a shared file or object during the narrow check-to-use window. After many attempts it wins the race, causing the privileged installer path to act on attacker-controlled content and execute code at elevated privilege. No public POC is identified, and the high attack complexity means the attacker likely needs many iterations to succeed.