Microsoft Windows Installer: Use-after-free leads to privilege escalation

Summary

A use-after-free flaw (CWE-416) in Windows Installer allows an authorized, locally logged-on attacker to elevate their privileges. Exploitation requires a foothold on the system, for example through a phished low-privilege user or a compromised service account, and the attack complexity is rated high. The flaw is not remotely exploitable. Microsoft has not reported public disclosure or active exploitation.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012, including Server Core (builds before 6.2.9200.26434)
• Windows Server 2012 R2, including Server Core (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Install the Windows security update from October 13, 2026 or later, which contains the fix for CVE-2026-83717.
• Fixed builds are at or above the build numbers listed under affected.
• KB numbers are not confirmed by Microsoft in the sources reviewed. Check the MSRC Security Update Guide for the correct KB per product.

Workaround

• Unknown. No vendor workaround was identified in the sources reviewed.
• Limit who can run installers and restrict local logon rights on sensitive systems as general hardening.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitability assessment 'Exploitation More Likely'.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog in the sources reviewed.
• No public proof of concept found in the sources reviewed.

Our recommendation

• Apply the October 2026 Windows security update to all affected hosts, prioritising Windows 10 1607/1809, Windows Server 2016/2019 and any remaining Windows Server 2012 systems.
• Verify the exact fixed build and KB number for each product on the MSRC Security Update Guide before rollout.
• Check whether any affected systems are out of support. Those cannot receive this fix and should be included in the replacement plan.
• Limit local accounts and service accounts to least privilege and monitor for unexpected privilege changes or installer activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83717 msrc.microsoft.com
• OpenCVE: CVE-2026-83717 app.opencve.io
• Strix.ai: CVE-2026-83717 www.strix.ai
• Vulners NVD mirror: CVE-2026-83717 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:25.