Microsoft Windows Installer: Elevation of privilege via use after free

Summary

A use-after-free flaw in the Windows Installer component allows an authorized local user to elevate privileges. An attacker needs a local foothold, such as a low-privileged account or malware, and the attack is considered high complexity. The CVSS score is 7.0 (High); the CNA's CVSS vector rates impact on confidentiality, integrity and availability as high.

Affected

• Windows 10 Version 1607 before 10.0.14393.9612
• Windows 10 Version 1809 before 10.0.17763.9376
• Windows 10 Version 21H2 before 10.0.19044.7807
• Windows 10 Version 22H2 before 10.0.19045.7807
• Windows 11 Version 23H2 before 10.0.22631.7652
• Windows 11 Version 24H2 before 10.0.26100.9711
• Windows 11 Version 25H2 before 10.0.26200.9711
• Windows 11 Version 26H1 before 10.0.28000.3231
• Windows 11 Version 26H2 before 10.0.26300.9711
• Windows Server 2012 before 6.2.9200.26434 (including Server Core)
• Windows Server 2012 R2 before 6.3.9600.23470 (including Server Core)
• Windows Server 2016 before 10.0.14393.9612

Note: the 22H2, 23H2 and Server ranges come from the CVE record and third-party data; verify on MSRC.

Fixed in

• Install the November 2026 security update for the affected Windows version.
• Exact fixed build numbers: verify on the MSRC advisory, as the source data could not be fully confirmed.

Workaround

• No vendor workaround known. Apply the security update.
• Until patched, limit interactive local logon and standard-user rights on shared systems.

Exploitation

• Microsoft's CVSS vector rates Exploit Code Maturity as Unproven (E:U).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No evidence of in-the-wild exploitation, public proof of concept or CISA KEV listing was found at the time of research.

Our recommendation

• Confirm the fixed build for each affected Windows version on the MSRC advisory and deploy the November 2026 cumulative update.
• Inventory Windows systems, prioritising servers, terminal servers and multi-user workstations.
• Check the support lifecycle of older builds (1607, 1809, 21H2), as they may no longer receive fixes.
• Re-check MSRC and the CISA KEV catalogue for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-96047 msrc.microsoft.com
• CVE Record CVE-2026-96047 www.cve.org
• Bleeping Computer: November 2026 Patch Tuesday www.bleepingcomputer.com
• Strix: CVE-2026-96047 (third-party data, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:47.