Windows Installer EUVD-2026-99498

Exploitation requires the attacker to already possess an authenticated, low-privileged local account on the target Windows system (PR:L, AV:L) and the ability to invoke Windows Installer (msiexec/MSI processing) on that host; it cannot be triggered remotely or by an unauthenticated user. No user interaction by a victim is needed (UI:N), and the flaw affects default Windows installations since Windows Installer is present on all supported client and server SKUs, but the local-only vector and prior-authentication requirement are the primary limiting factors. Impact is bounded to information disclosure (C:H, I:N, A:N) - it does not by itself grant code execution or privilege escalation.

This is a medium-severity (CVSS 5.5) local information-disclosure flaw and the signals are internally consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a local attack vector requiring low privileges (an authenticated/authorized local user) with low complexity and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with a CWE-125 out-of-bounds read that leaks memory. CISA's SSVC decision framework corroborates a modest priority: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial, which aligns with an info-leak rather than code execution. There is no CISA KEV listing and no public POC identified, and no EPSS score was provided in the input, so there is no signal of widespread or imminent exploitation. Net assessment: this is a genuine but lower-tier patch-in-normal-cycle issue, not an emergency - the local vector and low-privilege requirement meaningfully constrain real-world risk despite the 'high' confidentiality rating, and its main value to an attacker is as a post-compromise primitive (e.g., leaking memory to defeat ASLR or harvest secrets) rather than an initial-access vulnerability.

An attacker who already has a low-privileged local account on a Windows host invokes Windows Installer functionality in a way that triggers an out-of-bounds read, causing it to return adjacent process memory. The leaked data could include sensitive values such as pointers or secrets useful for defeating ASLR or chaining with another flaw. No public exploit code has been identified, and the local, authenticated nature of the bug makes it a post-compromise aid rather than a remote entry point.