Description

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-11T17:18:17.730Z",
  "pubdate": "2026-08-11T17:18:17.730Z",
  "executiveSummary": "This vulnerability is classified as a Use After Free (UAF) memory corruption flaw affecting the Windows Installer component. The security defect allows an authorized, locally authenticated attacker to execute arbitrary code and achieve local privilege escalation to higher integrity levels, such as SYSTEM.\nThe flaw stems from improper management of object lifetimes within memory during installation, repair, or uninstallation routines handled by the Windows Installer service. When a memory resource is freed but a dangling pointer continues to reference it, malicious manipulation of the freed heap memory can lead to arbitrary code execution.\nExploitation of this vulnerability requires local access to the target system and an existing level of authorization, meaning an attacker must already possess execution capabilities on the host. However, no specific user interaction or complex network exposure is mandated, as the attack vectors are entirely local.\nThe risk implications are severe, as a successful exploit compromises the confidentiality, integrity, and availability of the host operating system. Threat actors can leverage this elevation of privilege to bypass security controls, install persistent backdoors, access restricted system files, or pivot to other systems within a network environment. Organizations utilizing vulnerable versions of Windows Installer must prioritize security updates and apply vendor-supplied patches as soon as they become available to mitigate potential local exploitation risks.",
  "technicalDetails": "The vulnerability resides within the Windows Installer service handling of internal object allocation and deallocation routines. Specifically, the root cause is a Use After Free (UAF) condition where a memory object is prematurely freed or released during a specific sequence of installer transactions, but subsequent code execution paths attempt to reference the same memory address via a dangling pointer.\nFrom an exploitation perspective, an attacker with local access and authorization interacts with the Windows Installer Application Programming Interfaces (APIs) or command-line interfaces to trigger the vulnerable code path. The attack flow begins by instantiating a specially crafted installation package or invoking specific installer methods designed to allocate, free, and subsequently re-use the target memory heap structure.\nDuring the exploitation window, the attacker employs heap grooming and spraying techniques to populate the newly freed memory location with controlled payload data or malicious function pointers. When the Windows Installer service subsequently references the dangling pointer, execution is redirected to the attacker-controlled shellcode orROP (Return-Oriented Programming) chains residing in the reallocated heap space.\nBecause the Windows Installer service typically executes with elevated privileges (such as NT AUTHORITY\\SYSTEM), any code execution achieved through this memory corruption vulnerability inherits the security context of the service. Consequently, the attacker successfully escalates privileges from a standard user or restricted service account to full administrative control over the local operating system.\nPrerequisites for this attack include local host access and authorization to initiate installer routines. The vulnerability does not require network exposure, as all interactions occur via local Inter-Process Communication (IPC) or API calls directed at the local Windows Installer service. Post-exploitation impact includes complete system compromise, enabling the adversary to disable Endpoint Detection and Response (EDR) solutions, extract sensitive credentials from memory, and establish persistent unauthorized access."
}