Microsoft Windows Installer: Elevation of privilege via insecure library loading
Summary
Windows Installer contains an elevation of privilege vulnerability caused by insufficient input sanitization, which leads to insecure library loading. A locally authenticated attacker with a low-privileged account can run arbitrary code with SYSTEM privileges, then install programs, access or change data, or create accounts with full rights. The attack requires a logged-on user account and is not directly reachable from the internet, but it is relevant after a initial compromise such as phishing or malicious macros.
Affected
- Windows 10 Version 1607 (Server 2016 also affected): before 10.0.14393.9688
- Windows 10 Version 1809 (Server 2019 also affected): before 10.0.17763.9487
- Windows 10 Version 21H2: before 10.0.19044.7846
- Windows 10 Version 22H2: before 10.0.19045.7846 (secondary source, to be verified)
- Windows 11 Version 23H2: before 10.0.22631.7711 (secondary source, to be verified)
- Windows 11 Version 24H2: before 10.0.26100.9974 (secondary source, to be verified)
- Windows 11 Version 25H2 and 26H2: before 10.0.26200.9974 and 10.0.26300.9974 (secondary source for 25H2, to be verified)
- Windows 11 Version 26H1: before 10.0.28000.3501
- Windows Server 2022: before 10.0.20348.5870
Fixed in
- Install the November 2026 cumulative update for the affected Windows version (KB numbers to be confirmed in the MSRC advisory; KB5132059 and KB5132061 are named in news summaries but not mapped to this CVE).
Workaround
Unknown.
Exploitation
- Not confirmed as exploited in the wild (third-party source; Microsoft exploitation flag not verified).
- CVSS exploit code maturity: Unproven (E:U). No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Install the November 2026 Windows security update on all affected systems, prioritising shared workstations, terminal servers and hosts where untrusted users log in.
- Check the build numbers against the MSRC advisory before rollout, as the fixed builds are not fully verified.
- Check whether Windows 10 1607, 1809 or 21H2 are still in use and whether they are still supported.
- Restrict local user accounts and monitor for unexpected SYSTEM-level processes or new accounts.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Installer
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131085, KB5131090, KB5131096, KB5131080, KB5131077, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-105507 msrc.microsoft.com
- CVE.org record CVE-2026-105507 www.cve.org
- Strix.ai CVE-2026-105507 (secondary) www.strix.ai
- Senserva KB 5132061 (third party) senserva.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:35.
Original description (NVD)
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.