Microsoft Windows Installer: Heap-based buffer overflow leads to privilege escalation

Summary

A heap-based buffer overflow in the Windows Installer component allows an authorized local user to elevate privileges. The attack requires physical access to the device and an existing low-privileged account. The risk is highest on shared, unattended or guest-accessible Windows systems, and Microsoft has released fixes for all listed Windows and Server versions.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 and 25H2 and Version 26H2 (builds before 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows Server 2012 and Server Core installations (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installations (builds before 6.3.9600.23470)

Note: the CPE data lists only Windows 10 1607; the CNA record covers the wider Windows fleet.

Fixed in

• Install the latest Microsoft security update for CVE-2026-69635 from Windows Update or the Microsoft Update Catalog.
• Fixed builds according to the CNA record: 10.0.14393.9612 (1607 and Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Restart the system after patching so the Windows Installer service is refreshed.
• Verify the exact builds against the MSRC update guide before rollout.

Workaround

Unknown.

• No vendor workaround is documented; the patch is the documented remedy.
• Compensating measure: restrict physical and local logon access to shared machines and kiosks.

Exploitation

• No evidence of in-the-wild exploitation was found.
• No public proof of concept was found.
• MSRC exploit code maturity is Unproven (E:U).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS 0.00467 (low predicted exploitation probability).

Our recommendation

• Patch Windows 10 Version 1607 and Windows Server 2016 systems first, then the rest of the Windows fleet in the normal patch cycle.
• Check whether Windows 10 Version 1607 is still supported and plan an upgrade or Extended Security Updates if needed; verify the date on Microsoft's lifecycle page.
• Restrict physical and local logon access to shared, reception and guest devices.
• Verify that all affected devices have been restarted after patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69635 msrc.microsoft.com
• OpenCVE: CVE-2026-69635 app.opencve.io
• Vulners: CVE-2026-69635 vulners.com
• CyberStrike: CVE-2026-69635 cyberstrike.io
• VulDB: CVE-2026-69635 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 01:56.