Windows Installer: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in Windows Installer (CWE-122) allows a locally authenticated user with low privileges to escalate their privileges on the system. Successful exploitation can lead to a total loss of confidentiality, integrity and availability on the affected host. An attacker needs an existing local foothold, for example through a compromised standard user account, and no user interaction is required.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470

Fixed in

• Install the latest cumulative update for each affected Windows branch, which brings the build to or above the fixed build listed in the CNA record:
• Windows 10 1607 / Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2022 and 2025 are not listed in the CNA record. Verify the fixed build on the MSRC advisory.

Workaround

Unknown.

Exploitation

• No evidence of active exploitation in the wild found.
• CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
• No public proof of concept found in the searches performed; this is not a complete exclusion.
• EPSS is low (about 0.3%).

Our recommendation

• Install the security update from the MSRC advisory through the normal patch cycle, with priority on multi-user systems, terminal servers and shared PCs.
• Verify the fixed build on MSRC before rollout, especially for Windows Server 2022 and 2025.
• Limit local logon on shared systems and restrict local administrator rights so that fewer users can run installers.
• Recheck exploitation status and PoC availability before deployment and accelerate patching if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83779 msrc.microsoft.com
• OpenCVE: CVE-2026-83779 app.opencve.io
• Vulners: CVE-2026-83779 vulners.com
• Vulners MSCVE: MS:CVE-2026-83779 vulners.com
• Strix: CVE-2026-83779 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:03.