Windows Installer EUVD-2026-99944

Requires the attacker to already have local, authenticated access with low privileges (PR:L) on the target Windows system - there is no remote or unauthenticated path. Exploitation hinges on triggering an integer underflow leading to a heap buffer overflow (CWE-122) within Windows Installer, which per CVSS carries high attack complexity (AC:H), implying the attacker must satisfy specific timing or memory-layout conditions not reliably under their control. No user interaction is needed (UI:N) and scope is unchanged (S:U). Limiting factors for defenders: local access prerequisite, existing low-privilege account needed, and the high-complexity exploitation reduce realistic risk below the raw 7.0 score; patched builds (e.g., Windows 11 24H2 ≥10.0.26100.9711, Server 2022 ≥10.0.20348.5761) are not vulnerable.

This is a locally-exploitable elevation-of-privilege flaw (CWE-122 heap-based buffer overflow stemming from an integer underflow) in Windows Installer. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) indicates an authenticated local attacker who already holds low privileges, with high attack complexity, achieving full confidentiality, integrity, and availability impact - consistent with a privilege escalation to SYSTEM. CISA's SSVC framework aligns with a lower urgency: Exploitation=none (no observed exploitation), Automatable=no (the AC:H and local-access requirement make reliable mass exploitation hard), but Technical Impact=total (matching the C:H/I:H/A:H triple). No EPSS score was supplied, the CVE is not in CISA KEV, and no public POC is indicated, so there is no public exploit identified at time of analysis. Net assessment: a genuinely high-impact but not high-likelihood issue - it requires an attacker to already have a foothold on the host, and the high complexity limits spray-and-pray use. It is a standard 'patch in routine Patch Tuesday cycle, prioritize on multi-user/shared and sensitive hosts' item rather than an emergency. Note the signals are internally consistent (no conflict between CVSS local vector and the 'elevate privileges locally' description); the main gaps are the absent EPSS value and the lack of exploit-maturity data.

A low-privileged user (or malware running under a standard user account) on a Windows host triggers the integer underflow in Windows Installer during a package/MSI operation, corrupting heap memory to run attacker-controlled code at SYSTEM. Because attack complexity is high (AC:H), the attacker must win a race or satisfy specific memory-layout conditions, so exploitation is not trivial. No public exploit code is identified at time of analysis, so this scenario is theoretical based on the vulnerability class.