Windows 10 1607: Race condition in Windows Installer allows privilege escalation

Summary

A race condition (improper synchronization of a shared resource) in Windows Installer allows a local user to elevate privileges on Windows 10 version 1607. The attacker needs a valid local account and must win a timing condition, so attack complexity is high. Successful exploitation would give the attacker full control (high confidentiality, integrity and availability impact) on the affected host; the CVSS base score is 7.0 (High).

Affected

• Microsoft Windows 10 Version 1607, 10.0.14393.0 to before 10.0.14393.9612 (per the official CVE record)
• The official record also lists other Windows 10, Windows 11 and Windows Server versions; check the MSRC advisory for the complete list
• Whether 32-bit (x86) builds are affected is unverified.

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612 or later (per the official CVE record; verify against the MSRC advisory)
• The October 2026 security update is the expected fix. No KB number for Windows 10 1607 was confirmed.

Workaround

Unknown. No vendor workaround was found.

• Until patched, limit local logon to affected hosts to trusted users.
• Do not grant standard users rights to install software.
• Review Windows Installer policies that may widen installation privileges.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• Not found in the CISA KEV catalog in the checks performed; verify manually.
• EPSS about 0.002 (low predicted probability of exploitation in the next 30 days).
• No public proof-of-concept or exploit found.

Our recommendation

• Identify Windows 10 1607 systems and check their build number.
• Install the October 2026 security update on affected systems, after confirming the KB number and support status with Microsoft.
• Prioritise shared, multi-user, terminal server and RDS hosts.
• Check whether Windows 10 1607 still receives security updates; if not, plan an upgrade or extended security support.
• Monitor for unexpected privilege changes and new administrative accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83775 msrc.microsoft.com
• Vulners NVD record: CVE-2026-83775 vulners.com
• Vulners Microsoft CVE record: MS:CVE-2026-83775 vulners.com
• Vulners Rapid7 record: CVE-2026-83775 (Windows) vulners.com
• OpenCVE: CVE-2026-83775 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:15.