Windows Installer: Heap-based buffer overflow leads to privilege escalation

Summary

A heap-based buffer overflow in Windows Installer (msiexec) allows a local attacker with low privileges to elevate privileges, with a high impact on confidentiality, integrity and availability. The attacker needs a local, authenticated foothold, for example through a compromised user account or malware on a workstation or server. Exploitation is not automatable according to CISA SSVC, and no exploitation in the wild has been found.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (builds before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Ranges taken from the CVE record; verify per product in the MSRC entry

Fixed in

• Install the November 2026 security update for the affected Windows version (builds listed above or higher)
• Exact fixed builds per product: confirm in the MSRC Security Update Guide

Workaround

• No vendor-documented workaround known.
• Generic hardening, not verified for this CVE: set Group Policy 'Turn off Windows Installer' (DisableMSI) to Always on systems where user-initiated installations are not required, until patches are deployed. This may break software deployment, so test first.

Exploitation

• Exploited in the wild: no evidence found.
• Public proof of concept: none found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• CISA KEV listing: not found, but not verified directly.
• Microsoft exploitability rating: unknown.

Our recommendation

• Patch affected Windows clients and servers in the next regular update cycle, prioritising shared PCs, terminal servers, developer workstations and systems with many local users.
• Check the exposure: inventory affected Windows builds, including Windows 10 21H2/22H2 and Server 2016 to 2022.
• Verify the fixed builds in the MSRC entry and confirm whether Windows 11 24H2/25H2 are affected.
• Monitor for exploitation and KEV updates, and review local admin rights and endpoint protection.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96062 msrc.microsoft.com
• CVE Record: CVE-2026-96062 www.cve.org
• Strix.ai: CVE-2026-96062 www.strix.ai
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:38.