Windows Installer EUVD-2026-73097

Requires a local session with high-privileged (administrator-level) credentials on the target Windows host; the CVSS AV:L/AC:L/PR:H/UI:N vector confirms this. No special non-default configuration or specific software installation state is described as a prerequisite beyond having administrative rights and a reachable Windows Installer component. Exploitation is limited to local authenticated sessions - remote unauthenticated exploitation is not possible given AV:L and PR:H. The primary limiting factor is the PR:H requirement: an attacker must already possess administrative credentials, making this a second-stage escalation tool (e.g., admin-to-SYSTEM) rather than an initial compromise vector. The SYSTEM-level outcome may be relevant for bypassing Credential Guard, defeating endpoint agents running as SYSTEM, or achieving kernel-adjacent persistence.

The CVSS base score of 6.7 with AV:L/AC:L/PR:H/UI:N reflects a constrained but reliable exploitation path: local access and existing administrative (high) privileges are required before the flaw can be triggered. The Scope:Unchanged rating means exploitation stays within the Installer process security boundary, with the full C:H/I:H/A:H triad indicating SYSTEM-level code execution once achieved. This is not an initial-access vector; its real-world value is as a privilege-escalation step in a multi-stage attack chain where an adversary already holds a local admin session and seeks SYSTEM or kernel-level execution. No EPSS data is available in the provided intelligence, no CISA KEV listing exists, and no POC is identified, all of which reduce urgency relative to critical remote/unauthenticated bugs. However, the breadth of affected Windows SKUs - spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025 - makes this relevant across virtually every enterprise environment. Patch availability from Microsoft mitigates risk for organizations with current patch cycles.

An attacker who has already established a local administrative session on a Windows host - for example, via credential theft, lateral movement, or insider access - crafts a malformed MSI package or API call targeting the Windows Installer heap, triggering a controlled buffer overflow that overwrites heap control data. Execution is redirected to attacker shellcode running at SYSTEM privilege, enabling operations such as dumping LSASS memory for credential harvest, installing a persistent kernel-level implant, or disabling endpoint security products. No public POC is known at time of analysis, but the low AC:L rating indicates reliable exploitation without brute-forcing or race conditions once the prerequisite access is established.