Microsoft Windows Installer: Elevation of privilege via use after free

Summary

A use-after-free flaw (CWE-416) in Windows Installer allows an authorized local user to elevate privileges on the affected Windows client and server builds. The attacker needs a valid low-privileged account or code already running as a user, for example after phishing or malware. There is no network attack path, but a successful attack gives full control of the affected machine.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: builds 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: builds 10.0.26100.0 / 10.0.26200.0 / 10.0.26300.0 to below 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to below 10.0.28000.3231
• Windows Server 2012 and 2012 R2 (including Server Core): builds 6.2.9200.0 to below 6.2.9200.26434 and 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2025: affected (exact range not confirmed, see Open items in notes)

Fixed in

• Fixed in the builds listed as the upper limit of each affected range in the CVE record, for example 10.0.14393.9612 for Windows 10 1607 and Windows Server 2016
• Exact fixed build numbers for Windows Server 2025 and some other sources differ and could not be confirmed from a primary source. Check the MSRC Security Updates table for your version.
• Patch KB numbers reported by Tenable, not yet verified against MSRC: KB5126868 (1607 / Server 2016), KB5126651 (1809 / Server 2019), KB5126657 (21H2 / 22H2), KB5126653 (11 23H2), KB5127648 (11 24H2 / 25H2 / 26H2), KB5126646 (Server 2025), KB5126655 (Server 2022), KB5126835 and KB5126836 (Server 2012 and 2012 R2)

Workaround

Unknown. No workaround was found in the sources reviewed. Patching is the remedy until Microsoft states otherwise.

Exploitation

• Not exploited in the wild, according to Microsoft. Exploitability assessment: Exploitation Less Likely.
• Not publicly disclosed, according to Microsoft.
• No public proof of concept found in the sources checked.
• EPSS at the time of review: 0.00318 (low).
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Patch affected Windows systems in the normal monthly update cycle, using the update for each Windows version from Microsoft.
• Prioritise multi-user systems such as Remote Desktop or terminal servers, shared PCs and file servers, because a local privilege escalation there affects all users.
• Check whether any Windows 10 1607 systems are still in use and whether they are still covered by security updates (ESU enrolment). Plan replacement or ESU if needed.
• Limit standard-user rights and restrict software installation. Use application control such as AppLocker or WDAC to reduce the impact of local privilege escalation.
• Monitor for suspicious installer activity and unexpected privilege changes on endpoints and servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-87694 msrc.microsoft.com
• VulDB: CVE-2026-87694 vuldb.com
• Tenable: CVE-2026-87694 plugins www.tenable.com
• Strix: CVE-2026-87694 www.strix.ai
• OpenCVE: CVE-2026-87694 app.opencve.io
• Vulners: CVELIST CVE-2026-87694 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:42.