Windows Installer EUVD-2026-56597

Exploitation requires a valid low-privileged local user account on the target Windows system, as confirmed by the CVSS vector (AV:L/PR:L). The attacker must be able to invoke Windows Installer, which is a standard capability available to any authenticated local user on a default Windows installation - no special feature enablement, non-default configuration, or registry modification is required. No user interaction from a third party is needed (UI:N). Exploitation is strictly limited to local access; the AV:L metric confirms no remote or network-based exploitation path. Limiting factors include the requirement for an existing authenticated session on the target host - this vulnerability cannot be exploited by an unauthenticated remote attacker without first obtaining local access through a separate vector.

The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a high-severity, locally exploitable privilege escalation with no meaningful barriers beyond an active low-privilege user session - no special configuration, no elevated credentials, and no user interaction are required. The full CIA triad at High indicates complete system compromise post-exploitation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from the available data. This CVE is not listed in the CISA KEV catalog and no public POC has been identified, meaning active exploitation is not confirmed; however, local privilege escalation flaws in core Windows components are consistently weaponized in post-exploitation attack chains (e.g., following initial access via phishing or a remote vulnerability), making real-world risk materially higher than KEV absence alone would suggest. No conflicting signals exist between the CVSS vector and the description - both consistently indicate a local, low-privilege, low-complexity escalation path.

An attacker who has gained a low-privileged foothold on a Windows system - through phishing, credential reuse, or another initial access technique - triggers the Windows Installer service with a specially crafted MSI package or installation invocation that causes a heap buffer overflow. The overflow corrupts the SYSTEM-process heap, redirecting execution to attacker-controlled shellcode and yielding a SYSTEM shell. No public POC exists at time of analysis, but the low attack complexity (AC:L) suggests exploitation does not require precise heap layout manipulation or advanced techniques once the triggering input is identified.