Windows Installer EUVD-2026-99963

Exploitation requires the attacker to already possess authenticated low-privilege access to the target Windows system (PR:L) and local presence on the machine (AV:L) - this is strictly a local privilege-escalation primitive, not remotely reachable. The use-after-free must be triggered through a Windows Installer (msiexec/MSI) operation, and the high attack complexity (AC:H) indicates success depends on winning a memory-reclamation race condition that is not reliably repeatable. No user interaction by a victim is needed (UI:N). Limiting factors for defenders: the requirement for pre-existing local foothold, the non-default difficulty of winning the race, and the absence of any observed in-the-wild exploitation substantially reduce realistic risk relative to the 7.0 base score. Affected scope is broad across Windows 10/11 (through 26H2), Windows Server 2012 through 2025, including Server Core installations, below the patched build numbers listed in the EUVD data.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H → 7.0 High) describes a locally-exploitable use-after-free in Windows Installer that requires existing low-privilege access (PR:L) and high attack complexity (AC:H), yielding full confidentiality/integrity/availability impact on the local system. All non-CVSS exploitation signals point DOWNWARD: no CISA KEV listing, no public POC identified, and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' - only Technical Impact is 'total,' which merely reflects the full-system compromise if exploited, not the likelihood of exploitation. There is no EPSS score in the provided data, so probabilistic exploitation likelihood cannot be quantified. The signals are therefore consistent rather than conflicting: high potential impact but low current real-world exploitation pressure, gated behind local access and a difficult-to-win condition (AC:H, characteristic of a UAF race). This is a classic patch-in-normal-cadence privilege-escalation bug - valuable to an attacker who already has a foothold as a second-stage escalation primitive, but not an internet-facing emergency.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or another initial-access bug) triggers the use-after-free in Windows Installer, winning a race condition to reclaim freed memory and corrupt execution flow to run code as SYSTEM. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires precise timing. Success converts a limited user foothold into full local administrative control.