Windows Installer EUVD-2026-99363

Exploitation requires the attacker to already hold authenticated local access with at least low privileges on the target (CVSS PR:L, AV:L) - this is a privilege-escalation flaw, not a remote-access flaw, so it cannot be triggered over the network or by an unauthenticated actor. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning once a foothold exists, escalation to SYSTEM is reliable against affected (unpatched) versions of Windows Installer across Windows 10/11 and Windows Server 2012 through 2025. The primary limiting factor is the prerequisite local foothold; the affected versions are default Windows components requiring no special configuration, so any unpatched supported Windows system is exposed.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - the attacker must already have authenticated low-privilege access (PR:L) to the target, so this is not a remote entry point but a post-compromise escalation primitive. The CVSS vector is internally consistent with the description ('authorized attacker to elevate privileges locally'): local attack vector, low complexity, low privileges required, no user interaction, and full High impact to confidentiality, integrity and availability (SYSTEM-level compromise typical of Windows Installer EoP). No EPSS score, SSVC decision, or KEV listing was provided in the input, and no POC reference is present, so at the time of analysis there is no public exploit identified and no evidence of active exploitation. Real-world priority is driven by the ubiquity of Windows plus the low exploitation complexity and lack of required user interaction - Windows Installer EoP bugs are a historically favored second-stage technique - but in the absence of KEV/EPSS/POC signals this ranks as a standard high-priority patch-on-cycle item rather than an emergency, pending any future exploitation evidence from Microsoft or CISA.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) invokes a crafted interaction with the Windows Installer service to trigger a heap-based buffer overflow, corrupting heap memory to hijack execution in a higher-privileged context and gain SYSTEM privileges. No user interaction is required and attack complexity is low (AC:L), but local access is a prerequisite (AV:L). No public proof-of-concept exploit was identified in the provided data.