Executive brief
A security vulnerability has been identified in the Windows App Installer, a standard component used to install applications on Windows devices. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A stack-based buffer overflow (CWE-121) exists in the Windows App Installer component across multiple versions of Windows 10, Windows 11, and Windows Server. The vulnerability is triggered locally by an authenticated attacker with low privileges. By exploiting this memory corruption issue, the attacker can execute arbitrary code with elevated system privileges. The attack vector is local, requires no user interaction, and has a high impact on confidentiality, integrity, and availability. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows 10 Version 1607 10.0.14393.0 to 10.0.14393.9339
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2012 6.2.9200.0 to 6.2.9200.26226
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory