Windows Installer: Heap-based buffer overflow allows local privilege escalation

Summary

Microsoft Windows Installer, the component that installs, maintains and removes MSI packages, contains a heap-based buffer overflow (CWE-122). A local user with low privileges can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability. It is not a remote entry point and requires local access, for example after phishing has already provided code execution.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds 10.0.14393.0 before 10.0.14393.9612
• Windows 10 Version 1809: builds 10.0.17763.0 before 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 before 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 before 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 before 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: builds 10.0.26100.0, 10.0.26200.0 and 10.0.26300.0 before 9711 (per build line)
• Windows 11 Version 26H1: builds 10.0.28000.0 before 10.0.28000.3231
• Windows Server 2012 and 2012 R2 (including Server Core): 6.2.9200.0 before 6.2.9200.26434 and 6.3.9600.0 before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Server 2016: KB5126868 (OS Build 14393.9612, 13 Oct 2026)
• Later cumulative update for 1607: KB5134123 (OS Build 14393.9615, 26 Oct 2026)
• Unknown: the exact CVE-to-KB mapping has not been verified on the MSRC page.

Workaround

Unknown. No vendor mitigation was found. Install the security update.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• EPSS score 0.00318 (very low)
• Conflicting signal: a Tenable plugin for an October 2026 update flags an exploit and a KEV due date, but this may not apply to this CVE and is not verified
• Public proof of concept: unknown (none found)

Our recommendation

• Inventory all Windows 10 1607, LTSB 2016 and Windows Server 2016 systems.
• Install KB5134123 or the latest cumulative update where still supported, and confirm the fix on the MSRC page.
• Plan migration to a supported Windows version and confirm with Microsoft which servicing options (such as ESU) remain available.
• Give 1607 and LTSB 2016 endpoints and servers medium-high priority; patch other supported Windows systems in the normal monthly cycle (medium).
• Monitor for local privilege escalation, especially after phishing incidents.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85358 msrc.microsoft.com
• Windows 10 1607 security update KB5126868 support.microsoft.com
• Windows 10 1607 update KB5134123 support.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• OpenCVE: CVE-2026-85358 app.opencve.io
• Tenable plugin 365473 www.tenable.com
• Rapid7 via Vulners: CVE-2026-85358 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:17.