Windows Installer EUVD-2026-99764

Exploitation requires local access to the host and existing low-privileged authenticated execution (CVSS PR:L) - the attacker must already be able to run code or invoke the Windows Installer (msiexec) service on the target. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the flaw cannot be triggered remotely or by an unauthenticated attacker; it is a post-foothold escalation. Limiting factors: the target must be an unpatched Windows build below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650), and the attacker needs the ability to execute code locally, which typically presupposes an earlier compromise or a valid interactive/service account.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a local privilege-escalation flaw: the attacker must already have local access and low-level (PR:L) authenticated privileges, there is no user interaction, attack complexity is low, and successful exploitation yields full confidentiality, integrity, and availability impact (SYSTEM-level compromise typical of Windows Installer EoP). No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the intelligence, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. This is a genuinely useful second-stage vulnerability - a local foothold (malware, phishing-dropped code, or a low-privileged user) can be elevated to SYSTEM with low complexity - but it is not a remote, internet-facing threat and requires prior access, so it should be patched on the normal monthly Windows cadence rather than treated as an emergency unless local footholds are already a concern. Note a signal conflict: the input Tags include 'Denial Of Service', yet the description and CVSS (I:H, privilege elevation) point to code execution / EoP rather than DoS - the EoP framing should be treated as primary; the DoS tag likely reflects a secondary memory-corruption outcome and should be verified against the Microsoft advisory.

A low-privileged user or malware already running on a Windows host triggers a use-after-free in the Windows Installer service, reusing freed memory to corrupt a privileged object and gain code execution as SYSTEM. Because attack complexity is low and no user interaction is needed, this is a reliable local privilege-escalation primitive often chained after an initial foothold. No public proof-of-concept was identified in the provided intelligence.