EUVD-2026-99033
GHSA-qh89-h9vr-h6c9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliveryInvoke Windows Installer operation
-
ExploitWin use-after-free race condition
-
ExecutionExecute code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess a local, low-privileged authenticated session on the target Windows machine (PR:L, AV:L) - this is not remotely exploitable and needs no user interaction by a victim. Exploitation targets the Windows Installer (msiexec) service via a use-after-free that is timing/race dependent (AC:H), so success is probabilistic and may require repeated attempts to win the race window. No special non-default configuration is indicated; the limiting factors are the need for prior local access and the high exploitation complexity rather than any optional feature toggle. |
| Impact | This is a genuine but moderate-priority local privilege-escalation issue rather than a remotely-wormable emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) tells a consistent story: the attacker must already have local, authenticated access (PR:L), and exploitation is non-trivial (AC:H), typically indicating a race/timing-dependent use-after-free, but success yields full confidentiality, integrity and availability impact (effectively escalation to SYSTEM). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable near-term exploitation - this is a defense-in-depth patch, not a drop-everything fire. No SSVC decision data was supplied. The signals are internally coherent (local EoP with high complexity and no exploitation evidence), so the main caveat is simply that exploitation-probability data (EPSS/KEV/POC) is absent rather than confirmed-negative; absence of evidence is not evidence of absence, but nothing here elevates it above routine Patch-Tuesday prioritization for Windows fleets. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated foothold on a Windows host (e.g., via phishing or a standard user account) triggers a use-after-free in the Windows Installer service, winning a timing-dependent race to corrupt memory and run attacker-controlled code with SYSTEM privileges. Because the flaw is high-complexity (AC:H) and local-only (AV:L), reliable exploitation likely requires multiple attempts to hit the race window. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in Microsoft Windows Installer (msiexec) allows a low-privileged attacker who already holds an interactive session on a Windows host to elevate to higher integrity, including SYSTEM, by triggering a use-after-free memory corruption in the installer service. Successful exploitation requires winning a race/timing window (AC:H) rather than a simple reliable trigger, and no user interaction is needed from a victim; the CVSS 3.1 vector resolves to AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H for a base score of 7.0. At the time of analysis there is no public proof-of-concept and no confirmation of active exploitation (CISA KEV), so this is assessed as a genuine but moderate-priority privilege-escalation issue that matters most on multi-user, RDP-accessible, or shared-workstation deployments where untrusted users already have local logon rights.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-108468 as documented in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108468), which means installing the current monthly cumulative Windows update on all affected client and server builds - no exact fix build number is stated in the supplied data, so the version matrix in the MSRC advisory should be used to confirm coverage. Because the vulnerability is a local elevation of privilege requiring an existing low-privileged session (AV:L/PR:L) with timing-dependent exploitation (AC:H), prioritization should focus on hosts where untrusted users already have local logon: remote desktop and VDI hosts, jump boxes, shared/kiosk workstations, and multi-tenant systems. Until patching completes, compensating controls with clear trade-offs are: restrict interactive and RDP logon rights using the 'Allow log on locally' and Remote Desktop Users group policy so only trusted accounts can obtain a local session (reduces attack surface but may disrupt legitimate shared-use scenarios); apply WDAC or AppLocker rules to limit who may execute msiexec.exe and MSI/MSIX packages (blocks the attack path but will break legitimate software deployment workflows and requires careful allowlisting); remove or disable unnecessary local accounts and enforce least privilege so ordinary users do not hold the PR:L foothold the exploit requires (low operational cost, but does not remove the underlying bug); and enable EDR/telemetry alerting on unusual msiexec child-process creation, installer operations from user-writable paths, and repeated failed installer operations indicative of race attempts (detection-only, no prevention guarantee). None of these workarounds eliminate the memory-corruption defect, so the vendor update remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the Windows Installer service, the component that processes MSI/MSIX packages and runs with high privilege, typically as SYSTEM under the msiexec.exe broker. Use-after-free means a heap or pool object backing installer state is freed while a reference to it is retained, so a subsequent operation dereferences stale memory; an attacker who can influence the timing of concurrent installer operations can attempt to reuse that freed chunk and steer execution within the elevated installer context. Because the defect is a memory-safety/race condition, exploitation is inherently probabilistic - the CVSS AC:H rating and the local vector (AV:L) with low privileges (PR:L) and no user interaction (UI:N) reflect that an attacker needs both prior code execution as a normal user and repeated attempts to hit the timing window. Tags accompanying the record include Denial Of Service, Use After Free, Memory Corruption, and Microsoft, consistent with a pool/cleanup race in the installer rather than an authentication or logic bypass. No optional non-default feature or configuration is indicated as a prerequisite; the practical barriers are the requirement for existing local access and the difficulty of winning the race, not any missing service or setting.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only service accessible to any authenticated user (AV:L/PR:L), race-dependent UAF (AC:H), and successful escalation to SYSTEM grants full C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A locally exploitable privilege-escalation flaw in Microsoft Windows Installer (msiexec) affects Windows hosts and could let an attacker who already has a low-privileged interactive session escalate to SYSTEM-level integrity. The issue is rated HIGH (CVSS 7.0) but requires winning a race/timing window, and there is currently no public exploit and no confirmed active exploitation, so risk is concentrated on multi-user, RDP-accessible, and shared-workstation environments where untrusted users already have local logon rights. Leadership should care because unpatched local escalation on shared hosts erodes endpoint containment and can amplify the impact of any initial foothold, even though mass or remote exploitation is not currently indicated.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local and RDP logon to trusted users on multi-user and shared hosts; enforce least privilege and remove local admin rights from standard accounts; disable the Windows Installer (msiexec) service where software installation is not required; deploy EDR/behavioral monitoring for anomalous msiexec integrity-elevation and child-process activity; isolate RDP-exposed systems behind jump hosts and network controls; apply the vendor patch and validate coverage as soon as a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB