Windows Installer: Elevation of privilege via insecure library loading
Summary
Windows Installer does not properly sanitize input, which leads to insecure library loading. A locally authenticated attacker can run arbitrary code with SYSTEM privileges and then install programs, access or change data, or create accounts with full user rights. Exploitation requires a local account and high attack complexity, so the main risk is as a second stage after an initial compromise, especially on shared workstations and multi-user servers.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
- Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
- Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
- Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807 (third-party source, not confirmed by CNA record)
- Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
- Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
- Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
- Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
Fixed in
- Per the CNA record, the fix is included in the builds listed above as the first non-affected versions. Verify the exact fixed build per OS in the MSRC entry.
- Patch vehicle: Microsoft November 2026 security updates (Patch Tuesday, 10 Nov 2026). Package-to-CVE mapping not yet confirmed.
Workaround
- No vendor-published interim mitigation known. Patching is the remedy.
Exploitation
- No evidence of exploitation in the wild found.
- CVSS exploit maturity is Unproven (E:U).
- No public exploit found as of 10 Nov 2026.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Install the November 2026 cumulative updates on all Windows workstations and servers, starting with terminal servers and multi-user systems.
- Confirm the fixed build per OS in the MSRC advisory.
- Limit local accounts and restrict local logon where possible.
- Monitor for NVD analysis and any change in exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Installer
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126835, KB5126836, KB5126868, KB5126651, KB5126657, KB5126655
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105545 msrc.microsoft.com
- CVE Record CVE-2026-105545 www.cve.org
- VulDB entry 434555 vuldb.com
- Strix AI: CVE-2026-105545 www.strix.ai
- Rapid7: November 2026 Patch Tuesday www.rapid7.com
- Pureinfotech: November 2026 update pureinfotech.com
- CyberInsider: November 2026 Patch Tuesday cyberinsider.com
- TrinetriOps: November 2026 Patch Tuesday trinetriops.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:38.
Original description (NVD)
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.