Microsoft Windows Installer: Use-after-free leads to local privilege escalation

Summary

A use-after-free vulnerability in Windows Installer allows an authorized local user to elevate privileges. A successful attacker gets high impact on confidentiality, integrity and availability of the affected machine. Exploitation needs a local foothold and low privileges, attack complexity is high, and no exploitation or public exploit is known.

Affected

• Windows 10 Version 1607: builds before 10.0.14393.9612
• Windows 10 Version 1809: builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: listed as affected in the CNA record
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Versions 24H2, 25H2, 26H1 and 26H2: builds before 10.0.26100.9711, 10.0.26200.9711, 10.0.28000.3231 and 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): builds before 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2016: builds before 10.0.14393.9612

Fixed in

• Fixed builds per the CNA record (the first build number listed as affected is the fix)
• Windows 10 Version 22H2: 10.0.19045.7807 according to a secondary source; the CNA record is cut off here, so verify on MSRC
• Verify all build numbers on the MSRC advisory before rollout

Workaround

• None known. Neither the CNA record nor the secondary source lists a workaround, and no interim mitigation from Microsoft was found.

Exploitation

• Microsoft's CVSS vector marks exploit code maturity as Unproven (E:U).
• VulDB reports no known exploit.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No in-the-wild exploitation or public proof of concept was found; the CISA KEV catalogue was not checked.

Our recommendation

• Install the November 2026 Windows updates on all affected systems, after checking the fixed build numbers on the MSRC advisory.
• Restrict who can install MSI packages and limit local logon on shared or kiosk machines until patched.
• Monitor privileged installer activity with EDR logging.
• Priority: medium for most SMEs; raise to high where users are local administrators or endpoint coverage is weak.
• Patch together with the other Windows Installer elevation of privilege CVEs in the same batch.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96026 msrc.microsoft.com
• CVE Record CVE-2026-96026 (CNA: Microsoft) www.cve.org
• VulDB entry 435441 vuldb.com
• Strix CVE-2026-96026 (secondary mirror) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:48.