CVE-2026-70345: Windows Installer Privilege Escalation

CVE-2026-70345 Overview

CVE-2026-70345 is a heap-based buffer overflow vulnerability in Windows Installer that allows an authorized local attacker to elevate privileges. The flaw is categorized under [CWE-122] and affects the memory management routines used by the Windows Installer service. An attacker with local, low-privileged access can trigger memory corruption in the installer process. Because Windows Installer runs with elevated rights, successful exploitation can lead to SYSTEM-level code execution. Microsoft published details for this issue through the Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation grants attackers SYSTEM-level privileges on affected Windows hosts, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows (Windows Installer component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Systems where Windows Installer service is enabled

Discovery Timeline

2026-08-11 - CVE-2026-70345 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70345

Vulnerability Analysis

The vulnerability resides in Windows Installer, the Microsoft service (msiexec.exe) responsible for installing, maintaining, and removing software on Windows systems. Windows Installer processes Microsoft Installer (.msi) packages and transforms them into elevated system operations. Because the service runs under high-privilege contexts, memory-safety flaws within it directly translate into privilege escalation opportunities.

A heap-based buffer overflow occurs when the process writes data beyond the boundaries of a heap-allocated buffer. In the Windows Installer context, this typically stems from improper size validation when parsing installer metadata, custom actions, or transform files. Attackers craft input structures that force the installer to copy attacker-controlled data past the intended buffer boundary, corrupting adjacent heap chunks.

Root Cause

The underlying weakness is classified as [CWE-122] Heap-based Buffer Overflow. The installer allocates a fixed-size heap buffer and later copies attacker-influenced data into it without enforcing an adequate length check. Corruption of heap metadata or adjacent object pointers enables control-flow hijacking or privileged operation abuse within the installer process.

Attack Vector

Exploitation requires local access and low privileges (PR:L) but no user interaction. An authorized attacker on the target system stages a malicious installer artifact or invokes installer functionality with crafted parameters. When Windows Installer processes the crafted input, the heap overflow triggers under the SYSTEM security context. The attacker inherits those elevated privileges, achieving full local privilege escalation.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at publication. The EPSS probability is 0.246%. See the Microsoft Security Update CVE-2026-70345 advisory for technical guidance.

Detection Methods for CVE-2026-70345

Indicators of Compromise

Unexpected msiexec.exe process crashes or Windows Error Reporting entries referencing heap corruption
New child processes spawned by msiexec.exe running as NT AUTHORITY\SYSTEM outside of legitimate software deployments
Installation of unsigned or unexpected .msi packages from non-administrative user sessions
Creation of privileged local accounts or scheduled tasks shortly after installer activity

Detection Strategies

Monitor process creation events (Event ID 4688, Sysmon Event ID 1) where msiexec.exe is the parent of shells such as cmd.exe, powershell.exe, or rundll32.exe
Correlate Application Error events (Event ID 1000) referencing Windows Installer modules with subsequent privileged process creation
Detect low-privilege user contexts invoking msiexec.exe with unusual command-line switches or arbitrary file paths
Track modification of HKLM\Software\Microsoft\Windows\CurrentVersion\Installer keys by non-administrative users

Monitoring Recommendations

Baseline normal Windows Installer activity per host and alert on statistical deviations in frequency and origin
Forward Windows Installer, Application, and Security event logs to a centralized SIEM for retention and correlation
Enable command-line auditing and PowerShell script block logging to capture installer invocation chains
Review endpoint telemetry for heap corruption exceptions in msi.dll and related installer components

How to Mitigate CVE-2026-70345

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-70345 to all affected Windows systems
Prioritize patching on multi-user systems, terminal servers, and developer workstations where local users are present
Audit local user accounts and remove unnecessary interactive logon rights to reduce the pool of authorized attackers
Verify patch deployment via configuration management tooling and rescan endpoints for compliance

Patch Information

Microsoft has released a security update addressing the Windows Installer heap-based buffer overflow. Administrators should consult the Microsoft Security Update Guide entry for CVE-2026-70345 to identify the correct KB article and update package for each supported Windows version. Deploy the update through Windows Update, WSUS, Microsoft Intune, or an equivalent patch management pipeline.

Workarounds

Restrict installer execution by enforcing AlwaysInstallElevated policy set to disabled in both HKLM and HKCU
Use AppLocker or Windows Defender Application Control to block execution of untrusted .msi files by standard users
Limit local administrative privileges and remove standard users from groups that can stage installer packages
Increase monitoring cadence on unpatched systems until the vendor update is fully deployed

bash

# Verify the AlwaysInstallElevated policy is disabled to reduce installer abuse
reg query "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated

# Expected value: 0x0 (disabled) on both hives