Windows Installer EUVD-2026-99539

Exploitation requires the attacker to already have authenticated local access with at least low-level privileges (PR:L) on the target Windows host - there is no remote or unauthenticated path. The flaw is an out-of-bounds read within the Windows Installer component, so the attacker must be able to invoke or influence a Windows Installer (MSI) operation on the system; no special non-default configuration is described by the vendor, meaning default installations across the listed Windows client and server builds are affected. Limiting factors that reduce realistic risk: the need for a pre-existing local foothold, and the fact that the impact is confined to information disclosure (C:H, I:N, A:N) with no code execution or integrity/availability effect.

This is a moderate-severity local information-disclosure flaw (CVSS 5.5) whose signals are internally consistent and point to a genuinely low real-world priority rather than an urgent threat. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and existing low-level privileges, with high confidentiality impact but no integrity or availability effect - a classic memory over-read disclosure. CISA's SSVC decision framework corroborates this low urgency: Exploitation=none, Automatable=no, Technical Impact=partial, which aligns with a local-only bug that cannot be mass-automated across networks. No EPSS score, no KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. There is no conflict among the signals here - CVSS low complexity but local vector, SSVC 'none' exploitation, and absent KEV/POC all converge on a low-to-moderate priority best handled in routine monthly patching rather than emergency response. The main caveat is that EPSS data is entirely missing from the input, so exploitation probability could not be independently cross-checked; the assessment of low likelihood rests on SSVC and the absence of a POC/KEV signal.

A local attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-privilege service) triggers a malformed Windows Installer operation that causes an out-of-bounds read, leaking adjacent process memory. The disclosed memory could contain sensitive data such as handles, pointers, or secrets usable to aid further privilege escalation. No public exploit code was identified at time of analysis, and the local vector plus required privileges make opportunistic remote abuse infeasible.