Microsoft Windows Installer: Stack-based buffer overflow enables privilege escalation

Summary

A stack-based buffer overflow in Windows Installer allows a local user with low privileges to elevate privileges, potentially to SYSTEM level. The attack requires an attacker who already has a local foothold, such as a compromised user account or a malicious insider. The flaw is rated 7.8 (High) under CVSS 3.1 and has no known exploitation at the time of research.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2 and 22H2: 10.0.19044.0 to before 10.0.19044.7846 and 10.0.19045.0 to before 10.0.19045.7846 (listed in the CVE record excerpt; not confirmed by the MSRC page)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Note: the sources do not agree on all build numbers, so verify against the MSRC advisory.

Fixed in

• Fixed builds: the upper bound of each affected range is the first fixed build according to the CVE record. Exact fixed builds and KB numbers: Unknown (see MSRC advisory).
• Whether CVE-2026-96152 is included in the November 2026 release: Unknown.

Workaround

• No Microsoft workaround known. Patching is the only confirmed remedy.
• Interim measures (own suggestions, not from a source): limit local logon on multi-user hosts such as terminal servers and RDS; restrict standard users from installing MSI packages; confirm that the 'Always install with elevated privileges' policy is disabled.

Exploitation

• No known exploitation in the wild at the time of research.
• No public proof of concept found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• CVSS temporal vector includes E:U (exploit code maturity: Unproven).
• Absence of results is not a confirmed negative.

Our recommendation

• Apply the Microsoft update for the affected Windows versions, starting with multi-user servers and RDS/terminal servers, then workstations with local users.
• Check the MSRC advisory for the exact fixed builds and KB numbers, and confirm that the update is in the November 2026 release.
• Restrict who can log on locally to multi-user hosts and prevent standard users from installing MSI packages.
• Verify that 'Always install with elevated privileges' is disabled.
• Monitor for unexpected privilege escalation or new SYSTEM processes on affected hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-96152 msrc.microsoft.com
• CVE Record: CVE-2026-96152 (CVE.org) www.cve.org
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
• Strix: CVE-2026-96152 (third-party, unconfirmed details) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:31.