Microsoft Windows Installer: Elevation of privilege via use after free

Summary

A use-after-free flaw in Windows Installer allows an authorized local user to elevate privileges on the affected system. The attack requires local access and a low-privileged account, and the attacker must overcome a high attack complexity. The CVE record indicates a possible full compromise of confidentiality, integrity and availability on the local machine, but there is no evidence of exploitation.

Affected

• Windows 10 Version 1607: before 10.0.14393.9612
• Windows 10 Version 1809: before 10.0.17763.9376
• Windows 10 Version 21H2: before 10.0.19044.7807
• Windows 10 Version 22H2: reported as before 10.0.19045.7807 by a third-party aggregator, not yet confirmed by Microsoft
• Windows 11 Version 23H2: reported as before 10.0.22631.7652 by a third-party aggregator, not yet confirmed by Microsoft
• Windows Server 2012, 2012 R2 and 2016: see the Microsoft Security Update Guide for exact builds
• Windows 11 24H2/25H2/26H1/26H2 and Server 2025: unverified
• Unknown: complete affected-product list and KB numbers (Microsoft page not verified)

Fixed in

• Apply the Microsoft November 2026 security update for the affected Windows version.
• Fixed builds as listed in the CVE record: see the affected list above.
• Specific KB number: Unknown.

Workaround

• No workaround known.
• General risk reduction until patched: limit local administrator rights and use application control or endpoint protection that monitors privilege escalation.

Exploitation

• Exploited in the wild: no evidence found at publication.
• Public proof-of-concept: none found.
• CISA KEV: no entry found.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the November 2026 Microsoft security update on all affected Windows systems, prioritizing terminal servers and shared workstations.
• Check whether the listed builds (especially Windows 10 1607, 1809 and 21H2) are still supported or covered by ESU; plan upgrades where they are not.
• Limit local administrator rights and monitor for unusual privilege escalation.
• Verify the exact affected builds against the Microsoft Security Update Guide before reporting.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-96046 www.cve.org
• Microsoft Security Update Guide CVE-2026-96046 msrc.microsoft.com
• Strix CVE-2026-96046 (third-party, unverified) www.strix.ai
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:46.