Windows Installer EUVD-2026-99490

Exploitation requires the attacker to already possess authenticated local access to the target Windows host (PR:L) - this is a local privilege-escalation flaw (AV:L), not a remote one, so it cannot be reached across the network and is unsuitable for mass exploitation (SSVC Automatable=no). The attacker must be able to invoke the Windows Installer (msiexec/MSI service) and supply crafted input that overflows a heap buffer; no user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factor is the required pre-existing foothold with some level of privilege, meaning this is realistically a second-stage escalation step rather than an initial-access vector. The affected component (Windows Installer) is present by default on all supported Windows client and server editions listed in the EUVD data, so no non-default configuration is required once local access is obtained.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw requiring low-level authenticated access with no user interaction and low attack complexity, yielding total confidentiality, integrity, and availability impact on the local system. The CISA SSVC framework corroborates a measured risk posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-weaponized, consistent with a local-access precondition), but Technical Impact=total (full compromise of the affected component once exploited). There is no CISA KEV listing and no POC reported in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified from this input. The signals are internally consistent - a local-only EoP that is impactful but not remotely or automatically exploitable - so this is a real patch-management priority (classic second-stage escalation primitive) rather than an internet-facing fire drill. Note the one minor tension: the field states 'authorized attacker' while PR:L already encodes required privileges, confirming authentication is needed; this is not a contradiction but reinforces that an attacker must first gain a foothold.

An attacker who already has a low-privileged authenticated session on a Windows host (for example via phishing, stolen credentials, or an initial RCE) invokes the Windows Installer service with crafted input that triggers the heap-based buffer overflow, corrupting heap memory to hijack execution in a higher-privileged context and obtain SYSTEM-level control. No user interaction is required and attack complexity is low. No public proof-of-concept exploit was identified in the supplied data.