Windows Installer: Use-after-free enables local privilege escalation

Summary

Windows Installer, the Windows component behind MSI installs, repairs and uninstalls, contains a use-after-free flaw (CWE-416). A local user with low privileges and no user interaction can exploit it to elevate privileges on the system. Local access is required, so the main risk lies on shared workstations, multi-user systems and terminal servers rather than internet-facing services. Microsoft released a security update on October 13, 2026.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows Server 2016 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 and 25H2 and 26H2 (builds before 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows Server 2012 and 2012 R2 (builds before 6.2.9200.26434 / 6.3.9600.23470)

Fixed in

• Security update released by Microsoft on October 13, 2026 for each affected version.
• Fixed builds are listed in the CVE record above; confirm the KB article for your exact version on the MSRC page before rollout.

Workaround

• Unknown. No vendor workaround has been identified.
• Our suggestion: restrict who can install MSI packages on shared or multi-user machines and use least-privilege accounts and application control.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA Known Exploited Vulnerabilities catalog.
• No public proof-of-concept found in the sources checked; this does not rule out its existence.
• Unknown whether this bug has been used in attacks.

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows 10, Windows 11 and Windows Server systems, prioritising multi-user servers and terminal servers.
• Check which systems run Windows 10 Version 1607 or Windows Server 2016 and confirm their support status on Microsoft's lifecycle pages.
• Restrict local logon and MSI installation rights to necessary accounts and monitor for unexpected installer activity.
• Raise the priority if CISA KEV listing or a public exploit appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96308 msrc.microsoft.com
• OpenCVE: CVE-2026-96308 (CVE record, CISA ADP data) app.opencve.io
• Vulners: VulnRichment CVE-2026-96308 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:53.