Windows Installer EUVD-2026-99947

Exploitation requires the attacker to already hold valid low-privileged authenticated access to the target Windows host (PR:L) and to execute the attack locally (AV:L) - this is purely a local privilege-escalation flaw, not remotely reachable. The flaw lies in the Windows Installer (msiexec/MSI) service, so the attacker must induce that SYSTEM-privileged service to process attacker-influenced input. The key limiting factor is AC:H: successful exploitation depends on conditions the attacker does not fully control, such as winning a heap layout/timing race, making reliable exploitation difficult. No user interaction is required (UI:N). The vendor description does not name a specific non-default feature or configuration setting, so no configuration-dependent precondition can be confirmed beyond the authenticated-local-access requirement.

Signals are consistent and point to a moderate, non-urgent priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 HIGH) describes a local privilege-escalation flaw requiring an already-authenticated low-privileged foothold and a high-complexity exploit (AC:H implies the attacker must win a race or satisfy conditions outside their control, e.g. a heap grooming/timing window). CISA SSVC reinforces this: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited), but Technical Impact=total (full SYSTEM compromise if successful). This is NOT in CISA KEV and no public POC is indicated in the provided data, so there is no evidence of active exploitation or weaponization. The combination - total impact but local access, attacker authentication, high complexity, and no exploitation signal - makes this a solid 'patch in normal cycle' item rather than an out-of-band fire. EPSS score was not provided in the input and therefore cannot be factored in. The primary real-world value to an attacker is as a post-compromise local privilege-escalation link in a chain, not as an initial-access vector.

An attacker who already has low-privileged code execution on a Windows host (e.g. via phishing or a compromised standard user account) crafts a malicious input that triggers the heap-based buffer overflow in the Windows Installer service, which runs with SYSTEM privileges. Successfully winning the high-complexity exploitation window corrupts heap memory to execute attacker-controlled code as SYSTEM, achieving full local privilege escalation. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.