Executive brief
A security vulnerability has been identified in the Windows Installer, the standard service used by Windows to install and maintain software. An attacker who already has basic access to a computer could exploit a timing flaw to gain full administrative control over the system. This could allow them to view sensitive data, delete files, or install malicious software with high-level permissions.
Technical details
A race condition vulnerability (CWE-367) exists in the Windows Installer service. The flaw is a Time-of-Check Time-of-Use (TOCTOU) issue, where the service validates a file or resource but a window of opportunity exists for an attacker to replace that resource before it is actually used by the installer. An attacker with low-privileged local access can exploit this timing window to execute code with elevated system privileges. Microsoft has released security updates for various versions of Windows 10, Windows 11, and Windows Server to address this issue.
Affected products
- Microsoft Windows 10 Version 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Version 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2008 R2 Service Pack 1
Timeline
- 2026-01-13: disclosed
- 2026-01-13: advisory