Windows Installer EUVD-2026-99958

Requires the attacker to already have low-privileged local code execution on the Windows host (PR:L, AV:L) - there is no remote or network-facing attack path. Exploitation hinges on triggering and winning a use-after-free race within the Windows Installer service, which the CVSS AC:H rating marks as high-complexity and timing-dependent, so reliable exploitation is not guaranteed on each attempt. Limiting factors: local access is mandatory, no automation is feasible per SSVC (Automatable=no), and the vulnerable builds must be unpatched (versions below the fixed builds listed in the EUVD data, e.g. Windows 11 24H2 below 10.0.26100.9711); no user interaction (UI:N) and no non-default configuration are required to attempt the attack.

This is a legitimately dangerous-but-not-urgent flaw. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) describes a local, authenticated privilege escalation where the attacker already needs to run code on the host with low privileges and then win a use-after-free condition - reflected in AC:H. The SSVC framework reinforces a measured priority: Exploitation=none (no observed in-the-wild activity), Automatable=no (cannot be reliably scripted at scale, consistent with the race-condition nature of CWE-416 and AC:H), but Technical Impact=total (full compromise of the affected component, consistent with C:H/I:H/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so this is NOT a widespread-exploitation emergency; it is a high-impact local EoP that matters most as a post-compromise step. Signals are internally consistent - no conflict between the local vector, low-privilege prerequisite, and 'Exploitation: none' status. The main caveat is that the only references are the MSRC update-guide page and the NVD mirror; no technical write-up or exploitability detail beyond the one-line description was available to verify the exact trigger path.

A low-privileged attacker who already has code execution on a Windows host (e.g., a standard user account or a foothold from another bug) triggers a use-after-free in the Windows Installer (msiexec/MSI servicing) by racing a specifically-timed operation, corrupting freed memory to hijack execution in a higher-privileged context and gain SYSTEM-level rights. No user interaction is required, but the high attack complexity means the race must be won reliably. No public exploit code is identified at time of analysis.