Microsoft Windows Installer: Privilege escalation via use-after-free

Summary

A use-after-free flaw (CWE-416) in the Windows Installer component allows an authorized local user to elevate privileges. Successful exploitation requires a local logon and high attack complexity, and it can lead to SYSTEM-level control of the affected Windows host. The vulnerability is not reachable from the internet.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 (incl. Server Core): 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to below 6.3.9600.23470

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 26H2: 10.0.26100.9711 and 10.0.26300.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

KB numbers for Windows 10 1607 and Server 2016: Unknown. Confirm on the MSRC page.

Workaround

Unknown. No vendor-documented workaround has been identified. Applying the security update is the only known remedy.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog according to the research.
• No public proof of concept found in the research. This absence should be re-checked.

Our recommendation

• Install the Microsoft security update for CVE-2026-83702 on all affected systems, starting with shared workstations, terminal servers and Remote Desktop hosts.
• For Windows 10 1607: check Microsoft's lifecycle page. If the build is out of support, plan an upgrade, because it may receive no further patches.
• Check Windows Server 2016 and all other listed versions in the inventory, not only the CPE entry for 1607.
• Limit local accounts and standard-user malware exposure, and monitor for unexpected privilege changes.
• Patch related CVE-2026-83752 in the same cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83702 msrc.microsoft.com
• Vulners CNA record CVE-2026-83702 vulners.com
• Vulners NVD record CVE-2026-83702 vulners.com
• OpenCVE CVE-2026-83702 app.opencve.io
• Strix CVE-2026-83702 (third-party mirror of CNA data) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:32.