Windows Installer EUVD-2026-99896

Exploitation requires BOTH local physical access to the machine (AV:P) and an existing authenticated low-privilege user session (PR:L) on a vulnerable, unpatched Windows build - it is not remotely reachable and is not exploitable by an unauthenticated user. The vulnerable component is the Windows Installer service, present by default on all affected editions (Windows 10 1607-22H2, Windows 11 23H2-26H2, Windows Server 2012 through 2025, including Server Core). Limiting factors: the physical-presence and prior-authentication requirements, and the fact that affected systems must be below the fixed build (e.g. Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650); patched builds are not exploitable. No victim user interaction is required (UI:N).

This is a moderate-severity, low-urgency issue despite its 'total' technical impact. The CVSS 3.1 vector (AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 6.6) is the dominant constraint: exploitation requires PHYSICAL access to the device (AV:P) AND an already-authenticated low-privilege account (PR:L), which sharply limits the realistic attacker population to insiders or someone with hands-on device access. All three impact dimensions are High, so successful exploitation yields full SYSTEM-level control - consistent with SSVC 'Technical Impact: total'. However, the other real-world signals all point downward: SSVC reports 'Exploitation: none' and 'Automatable: no', there is no CISA KEV listing, and no public exploit was identified in the provided data. There is no apparent conflict between the signals - the CVSS physical/local-auth profile, the non-automatable SSVC rating, and the absence of KEV/EPSS data all coherently describe a privilege-escalation primitive that matters only after an attacker already has physical and account access. EPSS is not provided in the input and therefore cannot be cited. Net: this is a genuine local privilege-escalation flaw worth patching in the normal cycle, not an emergency, and it does not have the mass-exploitation characteristics of a remote network CVE.

An attacker with physical access to a Windows machine and a standard (low-privilege) user account triggers a heap-based buffer overflow in the Windows Installer service to corrupt memory and execute code as SYSTEM. No user interaction from a victim is needed, but the physical-presence and authentication requirements mean this is realistically an insider or evil-maid scenario. No public exploit code was identified at time of analysis.