Windows Installer EUVD-2026-99964

Exploitation requires the attacker to already possess authenticated low-privilege (PR:L) local access to the target Windows host; it cannot be launched remotely (AV:L). The flaw is a use-after-free in the Windows Installer (MSI) service, so a crafted local interaction with the installer code path is needed to trigger the dangling-pointer condition. High attack complexity (AC:H) indicates a timing/race or specific heap-state dependency that limits reliability and resists trivial weaponization. No user interaction is required (UI:N) and scope is unchanged (S:U). The primary limiting factors are the need for prior local foothold, valid low-level credentials, and the difficulty of reliably winning the race condition.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local privilege-escalation flaw requiring an attacker to already hold low-privilege authenticated access to the host, combined with high attack complexity - meaning the use-after-free likely depends on winning a race or satisfying specific timing/heap conditions that are not reliably reproducible. All three impact metrics are High (C:H/I:H/A:H), consistent with full SYSTEM compromise once exploited, and SSVC rates Technical Impact as 'total.' However, every exploitation signal is low: SSVC Exploitation is 'none,' SSVC Automatable is 'no,' there is no CISA KEV listing, and no public POC was provided. EPSS was not supplied in the input. The signals are mutually consistent rather than conflicting - high potential impact paired with difficult, high-complexity local exploitation and no observed exploitation. Net: a legitimate patch-management item (classic post-compromise EoP link in a chain) but not an emergency; the base-score of 7.0 is dampened by AC:H and the local, authenticated prerequisites.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) triggers a use-after-free in the Windows Installer service to corrupt memory and execute code in the SYSTEM context. Because AC:H, the attacker must reliably win a race or meet specific heap-state conditions, so exploitation may require multiple attempts. No public exploit code was identified at time of analysis.