Windows Installer: Local elevation of privilege

Summary

Windows Installer, the Windows service for installing, modifying and removing software packages, has an improper privilege management flaw that allows a locally authorized user to gain higher privileges. An attacker needs local access and an account with low privileges on the affected system, and the CVSS rating assumes high attack complexity. Microsoft reports no public disclosure and no known exploitation, and the CWE classification (race condition) does not fully match the description, so the exact trigger is unclear.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Versions 24H2, 25H2 and 26H2 (10.0.26100.0 to < 10.0.26100.9711; 10.0.26200.0 to < 10.0.26200.9711; 10.0.26300.0 to < 10.0.26300.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 to < 6.2.9200.26434; 6.3.9600.0 to < 6.3.9600.23470)

Fixed in

• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612 (KB5126868 for 1607 x64)
• Windows 10 1809: build 10.0.17763.9376
• Windows 10 21H2: build 10.0.19044.7807
• Windows 10 22H2: build 10.0.19045.7807
• Windows 11 23H2: build 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: builds 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 26H1: build 10.0.28000.3231
• Windows Server 2012 and 2012 R2: builds 6.2.9200.26434 and 6.3.9600.23470
• The KB number for the 32-bit Windows 10 1607 update is not confirmed.

Workaround

Unknown. Microsoft documents no workaround. Install the update and restrict local logon; least-privilege accounts for installers are general guidance, not a Microsoft recommendation.

Exploitation

• Not publicly disclosed and not known to be exploited, according to Microsoft
• CISA SSVC: exploitation none, not automatable, technical impact total
• EPSS score about 0.2%
• No public proof of concept found; the CISA KEV catalogue was not checked directly

Our recommendation

• Install the October 2026 security update and confirm build 10.0.14393.9612 or later on Windows 10 1607 and Windows Server 2016 systems
• Check all Windows systems against the full affected list, not only Windows 10 1607
• Plan the replacement of Windows 10 1607 and Windows Server 2016 systems, as they are legacy releases
• Restrict local logon and use least-privilege accounts for daily work
• Re-check the MSRC page and the CISA KEV catalogue weekly for the first month

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83899 msrc.microsoft.com
• Vulners NVD record CVE-2026-83899 vulners.com
• Vulners CVE List record CVE-2026-83899 vulners.com
• OpenCVE CVE-2026-83899 app.opencve.io
• NVD CVE-2020-0683 (earlier Windows Installer EoP, context only) nvd.nist.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:03.