Windows Installer EUVD-2026-73166

Exploitation requires an authenticated local user account with at minimum standard (low) privileges on the target system, confirmed by CVSS PR:L. The attacker must be capable of executing code locally (AV:L), meaning remote-only network access without an existing shell is insufficient. The high complexity metric (AC:H) indicates the UAF is not trivially triggered - successful exploitation likely requires precise timing, specific heap layout, or a carefully sequenced Windows Installer operation; this is not a one-click, no-skill exploit. No user interaction from a second privileged user is required (UI:N). No non-default Windows configuration is needed: Windows Installer is present and active in all default Windows installations, so no special feature enablement is required. Exploitation is concretely limited to: possession of a local authenticated account (domain or local), the ability to invoke or interact with Windows Installer processes, and sufficient technical skill to trigger the UAF reliably under AC:H conditions.

The CVSS base score of 7.0 captures a meaningful but bounded risk profile: exploitation requires authenticated local access (PR:L, AV:L) and high attack complexity (AC:H), which reflects the non-trivial heap manipulation or timing window that UAF exploitation typically demands. Despite AC:H tempering the base score, successful exploitation achieves full C:H/I:H/A:H impact, consistent with SYSTEM-level privilege escalation. CISA KEV status is not confirmed and no EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified from the available intelligence; no public exploit code has been identified. In practice, even a mid-sized municipal IT team in ustka should treat this as a patching priority given the ubiquitous Windows footprint and the fact that threat actors - particularly ransomware operators and APT groups - routinely weaponize local-privilege-escalation bugs as post-compromise steps after phishing or lateral movement. The AC:H constraint provides some real-world friction against commodity exploitation but should not be mistaken for immunity: skilled adversaries regularly develop reliable UAF exploits once they have local code execution. The broadness of affected SKUs (19 OS versions across client and server, including end-of-mainstream-support Windows Server 2012) amplifies overall organizational exposure.

An attacker who has gained a foothold on a Windows system as a standard (low-privileged) user invokes a crafted Windows Installer operation designed to trigger a specific heap state or race condition, exploiting the use-after-free to corrupt memory and redirect execution flow to attacker-controlled shellcode, ultimately achieving SYSTEM-level privileges. The high attack complexity means the attacker may require multiple attempts or precise heap grooming to reach a reliable exploitation state. No public proof-of-concept exploit has been identified at time of analysis.