Windows Installer EUVD-2026-99892

Exploitation requires the attacker to already hold valid low-privileged local access to the Windows host (PR:L) and the ability to invoke a Windows Installer (msiexec/MSI) operation that reaches the vulnerable heap-handling code path; the affected component is the Windows Installer service present by default in all listed Windows 10/11 and Windows Server 2012-2025 builds, so no non-default feature flag is implied by the data. The key limiting factors are: the vector is strictly local (AV:L), so there is no remote or network-facing exposure; prior authentication/code execution on the host is mandatory; and a vendor patch is already available, so exploitation is limited to unpatched systems below the fixed build numbers (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local privilege-escalation flaw requiring low-level authenticated access and no user interaction, yielding total CIA impact on the host - consistent with CWE-122 heap overflow in the Windows Installer service, which runs with SYSTEM privileges. The signals are internally consistent rather than conflicting: SSVC from CISA sets Exploitation=none and Automatable=no, matching a local-only vector that cannot be mass-exploited remotely, while Technical Impact=total matches the C:H/I:H/A:H impact set. There is no CISA KEV listing and no POC indicated in the input, and no EPSS score was provided - so there is no evidence of active exploitation, consistent with SSVC Exploitation=none. The practical risk is that of a reliable local EoP primitive: not wormable or remotely weaponizable, but highly valuable as a second-stage escalation after initial access, which is why Microsoft-class Installer EoP bugs are frequently patched promptly and should be prioritized in standard Patch Tuesday cycles. Note the absence of EPSS data limits probabilistic exploitation forecasting here; prioritization should lean on the local-EoP nature and broad Windows footprint rather than a quantified exploitation score.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing, a compromised standard user account, or a limited service) invokes a crafted MSI/installer operation that triggers the heap-based buffer overflow in the Windows Installer service. Because that service runs as SYSTEM, successful corruption of heap memory lets the attacker execute code at SYSTEM, fully compromising the machine. No public exploit identified at time of analysis, and no user interaction is required once the attacker has local access.