Microsoft Windows Installer: Use after free allows local privilege escalation

Summary

Windows Installer, the Windows component that installs, repairs and removes MSI packages, contains a use-after-free flaw (CWE-416, CWE-822). An authorized local user with low privileges can exploit it to gain elevated privileges on the system. Exploitation requires high attack complexity and a local foothold, so the main risk lies with shared workstations, terminal servers and multi-user systems.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846 according to a third-party aggregator; the CNA record entry is truncated)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Install the Microsoft security update for the affected product, which brings the build to the fixed version listed in the affected section (for example 10.0.14393.9688 or higher on Windows 10 1607 and Server 2016).
• Exact KB article numbers: Unknown. Check the Microsoft Security Update Guide.

Workaround

Unknown. No mitigation guidance was found in the sources checked.

Exploitation

• Exploited in the wild: no evidence found. The CNA record gives exploit code maturity Unproven (E:U). Microsoft's Exploitability field could not be verified.
• Public proof of concept: no evidence found.

Our recommendation

• Apply the Windows security update through the normal update cycle, with priority on servers, terminal servers and shared multi-user systems.
• Verify the Windows build numbers of all systems against the affected list, since many SMEs still run older Windows 10 builds.
• Limit local user accounts and interactive logons on shared systems to reduce exposure until patching is complete.
• Check the Microsoft Security Update Guide for the authoritative fixed builds and any mitigations, and check CISA KEV once the CVE has been evaluated.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96061 msrc.microsoft.com
• CVE.org record CVE-2026-96061 www.cve.org
• Strix CVE-2026-96061 (third-party aggregator) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:43.