Windows Installer: Use after free allows local privilege escalation

Summary

A use-after-free weakness (CWE-416, CWE-822) in Windows Installer allows an authorized local user with low privileges to elevate their privileges. The attack requires local access and a low-privileged account, and the attacker needs high attack complexity to succeed. CISA SSVC rates exploitation as none and automatability as no, and the vendor's exploitation flags were not available to us.

Affected

• Windows 10 Version 1607: builds before 10.0.14393.9612
• Windows 10 Version 1809: builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2012 (including Server Core): builds before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): builds before 6.3.9600.23470
• Windows Server 2016: builds before 10.0.14393.9612

Fixed in

Install the November 2026 security updates for the affected Windows versions. The fixed builds are the builds at or above the thresholds listed above. The KB numbers are unknown; see the MSRC advisory.

Workaround

Unknown. The vendor advisory was not accessible for this entry and should be checked for any mitigation.

Exploitation

• Exploited in the wild: Not confirmed.
• Public proof-of-concept exploit: None found.
• CISA SSVC: Exploitation none, automatable no, technical impact total.

Our recommendation

• Apply the November 2026 cumulative updates in the normal patch cycle, prioritising shared PCs, terminal servers and multi-user systems.
• Check the MSRC advisory for the exact KB numbers and any mitigation.
• Restrict which accounts can run MSI installations and remove unnecessary local administrator rights.
• Replace or plan upgrades for unsupported builds such as Windows 10 1607 and 1809, or check ESU eligibility.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96004 msrc.microsoft.com
• CVE.org record CVE-2026-96004 www.cve.org
• CVEProject cvelistV5 release (2026-11-11) github.com
• Strix.ai CVE-2026-96004 (secondary aggregator) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:51.