Windows Installer EUVD-2026-99580

Exploitation requires the attacker to already possess local, authenticated/authorized access to the target Windows system (PR:L) and the ability to execute code or invoke Windows Installer operations as a low-privileged user; it cannot be triggered remotely or by an unauthenticated party. No user interaction is needed (UI:N), and the affected component - the Windows Installer (msiexec/MSI service) - is present and enabled by default across all supported Windows 10/11 and Windows Server 2012 through 2025 builds listed in the EUVD data, so no special non-default configuration is required. The primary limiting factor is the need for a prior local foothold, which confines this to post-compromise privilege escalation rather than initial access.

This is a credible local privilege-escalation issue but not a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) shows local attack vector with low complexity, requiring low privileges (an authenticated/authorized local user) and no user interaction, yielding full high confidentiality, integrity and availability impact - consistent with a CWE-416 use-after-free in Windows Installer that an attacker leverages to escalate to SYSTEM. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation probability signals are absent rather than low - do NOT read the missing EPSS as evidence of low risk. SSVC-style reasoning: exploitation status is 'none' (no public exploit identified), automatable is effectively No (local vector requiring prior foothold), technical impact is Total. The practical priority is driven by the fact that Windows Installer runs with high privilege and this is a classic local EoP primitive favored in post-compromise chains, but it requires the attacker to already have code execution as a low-privileged user, which bounds real-world urgency below that of a remote unauthenticated flaw. No conflicting signals between the vector and description were found - both point to local, authorized, privilege-escalation.

An attacker who already has low-privileged authenticated access to a Windows host (e.g., via phishing, a compromised service account, or a web-exploit foothold) runs a crafted process that drives Windows Installer into a use-after-free, corrupting memory in a SYSTEM-level context. By controlling the freed-then-reused object, they execute code as SYSTEM and take full control of the machine. No public exploit was identified at time of analysis and no user interaction is required (UI:N).