Windows Installer EUVD-2026-99508

Exploitation requires the attacker to already possess local, authenticated low-privilege access (PR:L, AV:L) on an affected Windows system - this is not remotely reachable and cannot be triggered across a network. The flaw lies in the Windows Installer (msiexec/MSI handling) code path, so the attacker must be able to invoke an installer operation that reaches the vulnerable numeric-truncation/stack-overflow logic. No user interaction is needed (UI:N) and complexity is low (AC:L), so once a foothold exists, escalation to SYSTEM is reliable. Limiting factors: the mandatory pre-existing authenticated foothold, the local-only attack surface, and the requirement that the host run an unpatched affected build (e.g. Windows 10/11, Server 2012 through 2025 below the fixed revisions listed in EUVD).

This is a credible but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local privilege-escalation flaw: an attacker must already have authenticated low-privilege code execution on the host (PR:L) and attack locally (AV:L), with low complexity and no user interaction, yielding total confidentiality, integrity and availability impact on the same system (scope unchanged). CISA's SSVC framework aligns with this and tempers urgency: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local EoP that cannot be sprayed across the internet), while Technical Impact is 'total' (consistent with the C:H/I:H/A:H full-system compromise). There is no CISA KEV listing and no indication of public exploit code, so the status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. The signals are internally consistent: high technical impact but gated behind local authenticated access and not currently automatable or exploited, so this is a patch-in-normal-cycle local EoP rather than a fire-drill remote threat - though as a Windows Installer EoP it is a classic second-stage tool for attackers who already have a foothold. One data note: the description attributes a 'numeric truncation error' (a CWE-681-class integer defect) while the assigned CWE is CWE-121 (stack-based buffer overflow); these are related only if the truncation feeds an undersized buffer calculation - verify the precise root cause with Microsoft's advisory.

An attacker who already has a low-privileged authenticated session on a Windows host (for example via phishing-delivered malware or a compromised standard user account) invokes the vulnerable Windows Installer code path, triggering the numeric-truncation/stack buffer overflow to run code with SYSTEM privileges. No user interaction is required and attack complexity is low, but local access and an existing foothold are prerequisites. No public exploit code has been identified at the time of analysis.