Windows Installer: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in Windows Installer allows an authorized local user to elevate privileges on affected Windows 10, Windows 11 and Windows Server systems. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. The attacker needs a valid low-privileged local account, so the flaw is not a remote entry point.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846; fixed build from the CVE record not confirmed)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Fixed builds per the CVE record: the build numbers listed under Affected (first build without the flaw is the listed fixed version, e.g. 10.0.22631.7711 for Windows 11 23H2)
• Windows 11 cumulative updates of November 2026 (KB5132061 for 24H2/25H2/26H2, KB5131087 for 23H2) are reported as the fix vehicle; Windows 10 and Server update numbers are unconfirmed.
• Verify the exact build per product against the MSRC Security Update Guide.

Workaround

Unknown.

• No vendor workaround has been identified. Install the security update.

Exploitation

• No evidence of exploitation in the wild found for this CVE.
• No public proof of concept found.
• Not listed in CISA KEV in the sources reviewed.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the November 2026 Windows security updates on all affected systems, prioritising shared PCs, terminal and RDS servers and endpoints with many users.
• Check each machine's build against the MSRC table and confirm it is on a supported build or enrolled in Extended Security Updates.
• Restrict local logons and remove unneeded local accounts to reduce the chance of an attacker holding a low-privileged login.
• Monitor endpoints for unusual privilege changes and new administrative accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95951 msrc.microsoft.com
• CVE Record: CVE-2026-95951 www.cve.org
• Strix: CVE-2026-95951 (third-party mirror) www.strix.ai
• BleepingComputer: Windows 11 KB5132061 and KB5131087 cumulative updates www.bleepingcomputer.com
• Tenable: November 2026 Patch Tuesday www.tenable.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:57.