CVE-2026-62768: Windows Installer Privilege Escalation

CVE-2026-62768 Overview

CVE-2026-62768 is a stack-based buffer overflow [CWE-121] in Microsoft Windows Installer. An authorized local attacker can trigger the overflow to elevate privileges on the affected host. Microsoft published the advisory on 2026-08-11 and last updated the record on 2026-08-12.

The flaw carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Successful exploitation grants attackers SYSTEM-level execution from a standard user context. The current EPSS probability is 0.318% (24.4th percentile), and no public exploit code or in-the-wild activity has been reported.

Critical Impact
A local, authenticated attacker can overflow a stack buffer in Windows Installer to gain SYSTEM privileges, providing full control of the compromised endpoint.

Affected Products

Microsoft Windows (Windows Installer component) — refer to the Microsoft Security Update Guide for the definitive list of affected builds
Systems where the Windows Installer service (msiserver) is enabled
Endpoints permitting standard-user execution of .msi packages

Discovery Timeline

2026-08-11 - CVE-2026-62768 published to NVD and disclosed via Microsoft Security Update Guide
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-62768

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow inside Windows Installer, the Microsoft service that processes .msi and .msp packages. Windows Installer runs elevated components under the NT AUTHORITY\SYSTEM account through the msiserver service. When Installer parses an attacker-influenced input, it writes past a fixed-size stack buffer, corrupting the return address or adjacent stack data. Because the vulnerable code path executes in a privileged context, an authorized local user can hijack control flow and run code as SYSTEM.

Root Cause

The defect is classified as [CWE-121] Stack-based Buffer Overflow. The affected routine copies data into a fixed-length stack buffer without validating the input length against the buffer capacity. Standard stack mitigations such as /GS cookies and Control Flow Guard reduce, but do not eliminate, exploitability against a memory-corruption primitive that yields SYSTEM.

Attack Vector

Exploitation requires local access and low privileges (PR:L) and no user interaction (UI:N). A typical scenario involves a standard user invoking a crafted installer package or triggering an Installer RPC/COM interface with malformed arguments. The service processes the input in an elevated context, and the overflow allows the attacker to redirect execution before privileges are dropped. This class of flaw is commonly chained with initial-access techniques—such as phishing or drive-by download—to escape a low-privilege foothold.

No public proof-of-concept is available at the time of writing. Technical specifics are limited to the Microsoft Security Update Guide entry for CVE-2026-62768.

Detection Methods for CVE-2026-62768

Indicators of Compromise

Unexpected msiexec.exe or msiserver child processes spawning cmd.exe, powershell.exe, or other LOLBins under the SYSTEM account
Crashes or Windows Error Reporting entries referencing msi.dll, msiexec.exe, or msiserver immediately preceding privileged process creation
Installation activity originating from user-writable directories such as %TEMP%, %APPDATA%, or C:\Users\Public

Detection Strategies

Monitor for anomalous parent-child chains where a standard user session leads to SYSTEM-context execution via Windows Installer
Alert on execution of .msi files that were not delivered via managed software distribution channels such as SCCM, Intune, or Group Policy
Correlate Sysmon Event ID 1 (process create) and Event ID 11 (file create) with Security Event ID 4688 to identify unexpected token elevation following Installer activity

Monitoring Recommendations

Ingest Windows Installer logs, Security, and Sysmon telemetry into a centralized SIEM or data lake for retrospective hunting
Baseline normal msiexec.exe command-line patterns per host role and alert on deviations, especially non-standard /i, /quiet, or TRANSFORMS= arguments from user contexts
Track integrity-level transitions where a Medium integrity process launches a High or System integrity child through Installer

How to Mitigate CVE-2026-62768

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62768 across all affected Windows systems
Prioritize patching on multi-user systems, jump hosts, and virtual desktop infrastructure where local privilege escalation has the greatest blast radius
Audit local accounts and remove unnecessary standard-user access from sensitive hosts to reduce the exploitable population

Patch Information

Microsoft addressed CVE-2026-62768 in the August 2026 security update cycle. Administrators should deploy the update through Windows Update, WSUS, Microsoft Update Catalog, or their enterprise patching solution. Verify installation by confirming the corresponding KB article is present in wmic qfe list or Get-HotFix output on each endpoint.

Workarounds

Set the Group Policy Turn off Windows Installer (DisableMSI) to Always on hosts where user-initiated installations are not required, until patches are deployed
Restrict which users can invoke msiexec.exe through AppLocker or Windows Defender Application Control policies
Enforce least privilege by removing users from the local Administrators group and blocking execution of .msi files from user-writable paths

bash

# Registry configuration to disable non-managed Windows Installer usage
# HKLM policy applies machine-wide; requires reboot or service restart
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f

# Verify the August 2026 patch is present (replace KB with the KB listed in the MSRC advisory)
Get-HotFix | Where-Object { $_.HotFixID -eq "KBXXXXXXX" }