App Installer EUVD-2026-56469

Exploitation requires an authenticated local session with at least standard user privileges - confirmed by the CVSS vector (AV:L/PR:L), meaning the attacker must have interactive or remote desktop access to the target Windows system with a non-anonymous, non-administrative local or domain account. App Installer (version < 1.30.80) must be present and accessible to the user; since it ships by default on modern Windows, this is a common condition. No special configuration, no specific feature flag, and no administrator interaction are required per the AC:L/UI:N metrics. Exploitation is bounded to local access only - no network-exposed attack surface exists. Remote unauthenticated exploitation is not possible.

The CVSS score of 7.8 (High) is driven primarily by the full CIA impact (C:H/I:H/A:H) after successful exploitation, and by the low attack complexity and low privilege requirement. However, multiple secondary signals substantially moderate the assessed real-world priority. EPSS at 0.33% (26th percentile) indicates the broader threat intelligence community sees low near-term exploitation probability. SSVC confirms exploitation status as 'none' and automatable as 'no', consistent with the AV:L vector - mass automated exploitation across internet-exposed endpoints is not possible since the attacker must already have interactive local access. SSVC's 'technical impact: total' aligns with the CVSS CIA impact. No CISA KEV listing and no reported POC further reduce urgency. The net assessment: this is a genuine privilege escalation vulnerability worth patching promptly in environments where untrusted local users have shell access (e.g., shared workstations, VDI environments, developer machines with contractor access), but it is not an emergency for organizations where local user access is tightly controlled. No conflicting signals were identified between data sources.

An attacker who already has a standard (non-administrator) local user account on a Windows 10 or 11 system - for example, a contractor with a domain account, a rogue insider, or an attacker who has phished credentials for a limited account - invokes App Installer in a manner that triggers the improper privilege management flaw, escalating their process token or achieving code execution in a higher-privileged context (potentially SYSTEM). No public proof-of-concept exploit has been identified at the time of analysis, so the precise trigger mechanism is not publicly known.