Windows Installer EUVD-2026-99361

Exploitation requires the attacker to already hold a valid low-privileged local account on the target Windows system (PR:L, AV:L) and to interact with Windows Installer (MSI) operations to trigger the unsynchronized access to a shared resource. The key limiting factor is the race condition itself, reflected in AC:H: success depends on winning a narrow, non-deterministic timing window, so exploitation is typically unreliable and may require many repeated attempts - consistent with CISA SSVC marking it not automatable. No user interaction is needed (UI:N), and no special non-default configuration is indicated; the primary barriers are the prior authenticated foothold and the timing difficulty, making this most relevant on shared or multi-user Windows hosts.

This is a locally-exploitable elevation-of-privilege flaw with a moderate CVSS of 7.0, and the surrounding signals consistently point to lower real-world urgency than the HIGH-adjacent score suggests. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) requires local access, already-held low privileges, and a high-complexity attack - consistent with winning a timing-sensitive race condition rather than reliable one-shot exploitation. CISA's SSVC framework reinforces this: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (the race cannot be reliably scripted at scale), though Technical Impact is 'total' (full SYSTEM compromise if the race is won). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. There is no CISA KEV listing and no POC indicator, so this is not a confirmed active threat. Note a classification tension to verify with the vendor: the Description characterizes this as a race condition (CWE-362 behavior), while the assigned CWE-122 and the Tags (Buffer Overflow, Heap Overflow) describe a heap-based overflow - likely the race is the trigger that leads to heap corruption, but the primary weakness labeling is inconsistent. Overall this is a patch-in-routine-cycle local EoP, not an emergency; prioritize on multi-user or shared Windows hosts where a low-privileged attacker already has a foothold.

An attacker who already has a low-privileged interactive or service account on a Windows host repeatedly triggers Windows Installer operations to win a timing window in which a shared resource is accessed without proper synchronization, corrupting the heap to run code as SYSTEM. Because AC is High, success is non-deterministic and typically requires many attempts, and no public exploit code has been identified at time of analysis. This is a post-compromise privilege-escalation step rather than an initial-access vector.