CVE-2026-65774: Windows Installer Privilege Escalation

CVE-2026-65774 Overview

CVE-2026-65774 is a heap-based buffer overflow [CWE-122] in Windows Installer. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows host. Microsoft published the advisory on August 11, 2026, and the record was last updated on August 12, 2026.

Exploitation requires local access and low-privileged authenticated execution, but no user interaction. Successful abuse yields high impact to confidentiality, integrity, and availability, typically resulting in SYSTEM-level code execution through the Windows Installer service.

Critical Impact
A successful exploit lets a standard user escalate to SYSTEM through the Windows Installer service, bypassing local security boundaries and enabling full host compromise.

Affected Products

Microsoft Windows (Windows Installer component)
Refer to the Microsoft Vulnerability Advisory for the definitive list of affected builds
Both client and server Windows editions using the vulnerable msiexec service surface

Discovery Timeline

2026-08-11 - CVE-2026-65774 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65774

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Windows Installer, the Microsoft service that manages the installation, modification, and removal of software packages. Windows Installer runs with elevated privileges to perform system-level changes, which makes memory corruption inside its process boundary directly reachable from lower-privileged callers.

A local attacker with a valid user session can invoke the vulnerable Installer code path and supply crafted input that overruns a heap allocation. The overflow corrupts adjacent heap metadata or object pointers, giving the attacker primitives suitable for arbitrary code execution in the elevated Installer context.

Because Windows Installer is a common attack surface for privilege escalation, this weakness aligns with established local elevation-of-privilege patterns. The result is a full trust-boundary crossing from a standard user to SYSTEM.

Root Cause

The root cause is improper validation of a length or size value before copying attacker-influenced data into a fixed-size heap buffer inside Windows Installer. This matches the [CWE-122] pattern for heap-based buffer overflows. When the write extends past the allocated region, control-flow data in the heap can be manipulated to redirect execution.

Attack Vector

The attack is local and requires the attacker to already hold a low-privileged account on the target system. Exploitation involves triggering an installation, repair, or configuration operation through interfaces such as msiexec.exe, MSI packages, or Windows Installer COM APIs with malformed data.

No user interaction is required beyond the attacker's own session, and the attack complexity is low. Common post-exploitation outcomes include installing persistence, disabling security controls, or dumping credentials from LSASS after achieving SYSTEM.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-65774

Indicators of Compromise

Unexpected child processes of msiexec.exe running as NT AUTHORITY\SYSTEM and spawning cmd.exe, powershell.exe, or rundll32.exe
MSI packages executed from user-writable paths such as %TEMP%, %APPDATA%, or C:\Users\Public
Crashes or Windows Error Reporting entries citing msiexec.exe or msi.dll heap corruption
New services, scheduled tasks, or local accounts created shortly after a Windows Installer invocation by a standard user

Detection Strategies

Monitor process lineage for msiexec.exe invocations that originate from non-administrative users and result in privileged child processes
Alert on Windows Installer activity outside of patch windows, software deployment tooling, or approved package sources
Correlate Windows Installer events (Event IDs 1022, 1033, 1040 in the Application log) with subsequent token elevation or privilege assignment events

Monitoring Recommendations

Enable command-line auditing (Audit Process Creation with ProcessCommandLine) to capture full msiexec arguments
Ingest Sysmon Event ID 1 and 10 telemetry to track process creation and process access targeting msiexec.exe
Track integrity-level transitions where a medium-integrity process spawns a high or system-integrity child

How to Mitigate CVE-2026-65774

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory as soon as it is available for your build
Inventory endpoints running vulnerable Windows Installer versions and prioritize multi-user systems, jump hosts, and privileged workstations
Restrict interactive and remote logon rights for untrusted users on high-value hosts until patching completes

Patch Information

Microsoft has issued guidance for CVE-2026-65774 through the Microsoft Security Response Center. Administrators should consult the Microsoft Vulnerability Advisory for the specific KB article, build numbers, and rollout instructions applicable to their Windows version.

Workarounds

Enforce the AlwaysInstallElevated policy set to 0 in both HKLM and HKCU to prevent MSI packages from installing with elevated privileges by default
Apply AppLocker or Windows Defender Application Control rules to block execution of unsigned MSI packages from user-writable locations
Limit membership in local Administrators and Users groups on shared systems to reduce the pool of accounts capable of triggering the flaw
Use software restriction policies to require signed installers from trusted publishers only

bash

# Disable AlwaysInstallElevated to reduce Windows Installer EoP exposure
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f