Microsoft Windows Installer: Elevation of privilege via NULL pointer dereference

Summary

A NULL pointer dereference in Windows Installer allows an authorized, locally logged-on attacker to elevate privileges on the affected Windows system. The CNA rates the issue 7.8 (High) with high impact on confidentiality, integrity and availability. Exploitation requires a low-privileged local account and no user interaction, so the risk is mainly for shared machines, terminal servers and systems where an attacker already has a foothold.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2 and Version 26H2: builds before 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Install the current Microsoft security update for your Windows version (cumulative update from November 2026 or later).
• Minimum fixed builds per the CNA record are listed under Affected.
• KB numbers: Unknown. Check the Microsoft Security Update Guide.

Workaround

Unknown.

Exploitation

• No public proof of concept or in-the-wild exploitation known at the time of analysis.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• NVD status: Awaiting Analysis.

Our recommendation

• Apply the November 2026 Windows security updates, starting with servers, Remote Desktop/terminal servers and shared workstations.
• Prioritise Windows 10 1607, 1809 and 21H2 systems, which are older and more likely to be left behind.
• Verify the installed build numbers against the Microsoft Security Update Guide, as the list here is taken from the CNA record.
• Monitor for a public proof of concept or a CISA KEV listing.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105543 msrc.microsoft.com
• CVE Record CVE-2026-105543 (CVE Program) www.cve.org
• VulDB entry 434589 (third-party, score discrepancy) vuldb.com
• Strix aggregator entry CVE-2026-105543 (provisional, third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:32.