Windows Installer: Local privilege escalation via numeric truncation error

Summary

Windows Installer, the Windows component that installs and maintains MSI packages, contains a numeric truncation error that allows an authorized attacker to elevate privileges locally. The attacker needs a local foothold with low privileges, for example through malware, a phishing payload or an insider, and no user interaction is required. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected system. The CVSS 3.1 base score is 7.8 (High).

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds below 6.3.9600.23470)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Version ranges taken from the CNA record; verify them on the MSRC page.

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2016: 10.0.14393.9612
• The Microsoft security update for CVE-2026-85796 is the fix. KB numbers are not confirmed in the sources.

Workaround

Unknown. No vendor-documented workaround was found. Install the security update.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept or exploitation reports were found.
• Not listed in the CISA KEV catalog according to a third-party mirror.
• EPSS is very low (around 0.003, per a third-party mirror).

Our recommendation

• Inventory all Windows systems, especially Windows 10 1607 and Windows Server 2012/2016, and compare their build numbers with the fixed versions.
• Install the Microsoft security update for CVE-2026-85796 together with the latest cumulative updates.
• Check the Microsoft lifecycle page for the support status of Windows 10 1607 and plan upgrades for unsupported systems.
• Limit local administrator rights and monitor for unexpected installer activity.
• Prioritize systems where untrusted users or software could run locally.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85796 msrc.microsoft.com
• NVD mirror with version ranges (Vulners) vulners.com
• OpenCVE: CVE-2026-85796 app.opencve.io
• Rapid7 mirror (EPSS, CWE) (Vulners) vulners.com
• Strix: CVE-2026-85796 (third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:11.