Executive brief
Windows Installer, a core system component responsible for deploying and managing software on Windows machines, contains a use-after-free vulnerability that allows a locally authenticated user to escalate their privileges. An attacker with local access to a Windows system could exploit this flaw to gain elevated (administrator) privileges, potentially leading to full control of the affected machine.
Technical details
A use-after-free vulnerability exists in the Windows Installer component, where a freed memory region is accessed after deallocation. The vulnerability requires local access and authentication (the attacker must have a valid user account on the system). An authenticated local attacker can trigger the use-after-free condition to achieve privilege escalation from a standard user account to SYSTEM or administrator level, enabling full control of the machine. Microsoft has released patches to remediate this issue.
Affected products
- Microsoft Windows Installer
Timeline
- 2026-09-08: disclosed