Windows Installer EUVD-2026-99340

Exploitation requires the attacker to already hold an authenticated low-privileged local account on the target Windows host (AV:L, PR:L) - there is no remote or network-reachable path and no user interaction by a victim is needed (UI:N). The attacker must locally interact with the Windows Installer service/component to supply the overflowing input. The High attack complexity (AC:H) indicates a meaningful limiting factor beyond mere access - typically a race condition or a specific, attacker-influenced-but-not-fully-controlled system state that must be met for the stack overflow to be reliably triggered. Realistic risk is therefore concentrated on multi-user or shared systems (terminal servers, RDS hosts, shared workstations) where untrusted standard users coexist; on single-user endpoints the bug principally aids privilege escalation after an initial compromise. The specific feature flag, MSI operation, or configuration that supplies the vulnerable input is not detailed in the available NVD/EUVD description and would need confirmation from the Microsoft MSRC advisory.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.0 is driven by total technical impact (C:H/I:H/A:H) but tempered by a local attack vector (AV:L), high attack complexity (AC:H), and a requirement for pre-existing low privileges (PR:L) - meaning the attacker must already have a foothold on the host and win a non-trivial condition (likely a race or specific state) to succeed. All exploitation-maturity signals point the same, consistent direction toward lower urgency: it is NOT on the CISA KEV list, SSVC explicitly records Exploitation: none and Automatable: no, and no public proof-of-concept is referenced. The only signal elevating concern is SSVC Technical Impact: total, which aligns with the CVSS 'total' impact triad. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed - this is a genuine data gap, not a low-risk confirmation. The signals are coherent (no contradictions between CVSS, SSVC, and KEV/POC status): this reads as a classic local elevation-of-privilege (EoP) bug useful as a post-compromise chaining step, not a remotely wormable threat. Prioritize via normal Patch Tuesday cadence, with faster remediation on multi-user, terminal-server, or shared hosts where untrusted low-privileged users exist.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, stolen credentials, or a prior exploit) invokes Windows Installer in a way that triggers the stack-based buffer overflow, corrupting the stack to execute code at a higher privilege level (SYSTEM). Because attack complexity is High, success likely depends on winning a race condition or achieving a specific system state rather than a single deterministic action, and no public exploit code has been identified at time of analysis.