Executive brief
Windows Installer, a core Microsoft system component for installing and managing software, contains a race condition vulnerability that allows an authorized local attacker to escalate their privileges to higher system levels. This could enable an attacker with limited account access to gain administrative control over a Windows computer, potentially leading to data theft, malware installation, or system compromise.
Technical details
The vulnerability is a concurrent execution race condition in a shared resource within Windows Installer that lacks proper synchronization mechanisms. An authorized local attacker can exploit this during the installation process to achieve privilege escalation. The attack requires local access and authentication, and does not appear to be currently exploited in the wild.
Affected products
- Microsoft Windows Installer
Timeline
- 2026-09-08: disclosed