Windows Installer EUVD-2026-99979

Requires the attacker to already hold a low-privileged authenticated local account on the target Windows system (PR:L, AV:L) - there is no remote or unauthenticated path. Exploitation specifically abuses the Windows Installer (MSI) service to trigger a use-after-free, and the high attack complexity (AC:H) means success depends on reliably winning a memory-reuse timing race, which is non-deterministic and limits practical weaponization. Limiting factors: local access prerequisite, existing authentication, and the race-condition reliability barrier; no user interaction (UI:N) is needed once the attacker has local code execution.

Signals point to a credible but non-urgent local privilege-escalation issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms the attacker must already have local, authenticated (low-privilege) access AND overcome high attack complexity - characteristic of the race/timing window typical of use-after-free (CWE-416) flaws - which meaningfully dampens the 7.0 base score and total technical impact (C:H/I:H/A:H). CISA's SSVC framework reinforces this: Exploitation=none (no observed exploitation) and Automatable=no, even though Technical Impact=total. There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. No signals conflict: local-only vector, high complexity, required privileges, and SSVC 'Exploitation: none' all consistently indicate a real-but-lower-priority patch - important for hardened/multi-user Windows hosts where an authenticated foothold already exists, but not an internet-facing or wormable threat. A vendor patch is available and should be applied on normal Patch Tuesday cadence, prioritized higher on shared/terminal-server systems.

An attacker who already has a low-privileged authenticated account on a Windows host (e.g., via phishing, a prior foothold, or a standard user on a shared/terminal server) runs a crafted program that abuses the Windows Installer service to trigger a use-after-free, winning a timing race to reclaim the freed object and execute code at SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means exploitation requires reliably hitting a narrow race window.