Windows Installer EUVD-2026-99988

Exploitation requires the attacker to already possess an authenticated low-privileged local session on the target Windows system (CVSS PR:L, AV:L) - there is no remote or network-triggerable path and no user interaction by a victim is involved (UI:N). The vulnerable component is Windows Installer (msiexec/MSI processing), present by default in all supported Windows editions, so no non-default configuration is needed to reach the code. The principal limiting factor is the local-access prerequisite: an attacker without an existing foothold cannot reach this vulnerability, which is why SSVC rates it Automatable:no. It is realistically used as a privilege-escalation link in a larger intrusion chain rather than as an initial-access vector.

This is a credible but not emergency-priority local privilege-escalation flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent: it requires local access and some existing privileges (PR:L) but no user interaction, and yields total confidentiality, integrity, and availability impact - matching the SSVC 'Technical Impact: total' rating. However, the exploitation signals argue against treating this as a top-of-queue item: it is NOT in CISA KEV, SSVC reports 'Exploitation: none' (no observed or public exploitation), 'Automatable: no' (cannot be reliably weaponized at scale because an attacker must already have a local foothold), and no POC or EPSS score was provided in the input. These signals are consistent with each other - all pointing to low current real-world exploitation despite the high technical impact. The practical risk is therefore moderate: dangerous as a post-compromise escalation primitive (e.g., chained after phishing or an initial RCE) but not a mass-exploitable remote threat. EPSS data was not supplied, so probabilistic exploitation likelihood could not be weighed; this is a gap rather than a conflict.

An attacker who already has a low-privileged local account on a Windows host (for example after phishing, malware drop, or a prior foothold) invokes the vulnerable Windows Installer (msiexec) code path with crafted input that overflows a stack buffer, overwriting control data to execute code in the context of the SYSTEM-level installer service. This converts limited user access into full SYSTEM control. No public exploit code was identified at time of analysis, and CVSS AC:L indicates the overflow is reliably triggerable once local access is obtained.