Windows Installer EUVD-2026-99763

Exploitation requires the attacker to already have local, authenticated access to the host as a low-privileged user (PR:L) who can interact with the Windows Installer service; no user interaction by a victim is needed (UI:N). The primary limiting factor is high attack complexity (AC:H): the use-after-free is a memory-corruption race condition that demands precise timing to free and reclaim the object, so exploitation is not guaranteed on a single attempt and may fail under hardened or heavily loaded conditions. It is not remotely reachable (AV:L) and cannot be triggered by an unauthenticated attacker; it affects default configurations of the listed Windows client and server versions prior to the patched builds, so no special non-default feature needs to be enabled.

This is a moderate-priority local privilege escalation (CVSS 7.0) affecting the Windows Installer component across virtually the entire supported Windows ecosystem. The signals are internally consistent and point away from an urgent, mass-exploitation scenario: the CVSS vector is AV:L/AC:H/PR:L (local access, high attack complexity, requires an already-authenticated low-privileged user), and CISA's SSVC framework corroborates this with Exploitation='none' and Automatable='no'. The one signal pulling upward is SSVC Technical Impact='total', matching the CVSS C:H/I:H/A:H (full SYSTEM-level compromise if successful). No EPSS score was supplied in the input, and there is no KEV listing and no evidence of public exploit code, so exploitation probability cannot be quantified but the qualitative signals (AC:H, UAF requiring a race/timing window, no automatability) suggest low near-term likelihood. Net: a real but not top-tier priority - a reliable local EoP primitive valuable as a second-stage escalation after initial foothold, rather than an internet-facing emergency. Prioritize patching for high-value/multi-user hosts; the broad Windows footprint raises aggregate exposure even though per-host exploitability is gated by AC:H and local authenticated access.

An attacker who has already gained low-privileged authenticated code execution on a Windows host (e.g., via phishing or a prior foothold) triggers a use-after-free condition in the Windows Installer service, winning a timing/race window to manipulate freed memory and execute attacker-controlled code at SYSTEM. Because AC:H reflects a non-trivial race, the attacker may need multiple attempts, but success yields full local compromise (C:H/I:H/A:H). No public proof-of-concept exploit was identified in the provided data.