CVE-2026-70346 Overview
CVE-2026-70346 is a stack-based buffer overflow vulnerability in Windows Installer that allows a locally authenticated attacker to elevate privileges. The flaw is classified under [CWE-121: Stack-based Buffer Overflow] and carries a CVSS 3.1 score of 7.8. Successful exploitation grants the attacker high confidentiality, integrity, and availability impact on the affected host. Microsoft published the advisory through its Security Update Guide. The vulnerability requires local access and low privileges but no user interaction, making it a practical post-compromise escalation path.
Critical Impact
An authorized local attacker can trigger a stack buffer overflow in Windows Installer to gain elevated privileges and execute code in a higher security context.
Affected Products
- Microsoft Windows (Windows Installer component)
- Refer to the Microsoft Security Update Guide for the complete list of affected builds
- Specific product versions were not enumerated in the NVD entry at publication time
Discovery Timeline
- 2026-08-11 - CVE-2026-70346 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-70346
Vulnerability Analysis
The vulnerability resides in the Windows Installer service, which processes .msi packages and related installation transactions under elevated privileges. A stack-based buffer overflow [CWE-121] occurs when the component writes attacker-influenced data beyond the bounds of a fixed-size stack buffer. Because Windows Installer executes with SYSTEM-level context during installation operations, corruption of the stack frame can lead to control-flow hijacking or memory tampering in a privileged process. An authenticated local user can craft input that triggers the overflow during an installer operation, achieving privilege elevation.
Root Cause
The root cause is missing or inadequate length validation on attacker-controlled input consumed by Windows Installer routines. When the routine copies this input into a fixed-size stack buffer, adjacent stack data including saved return addresses or frame pointers can be overwritten. Microsoft has not released detailed technical internals for the affected function.
Attack Vector
Exploitation requires local access with low privileges. The attacker interacts with Windows Installer, for example by initiating an install, repair, or advertised action with a malformed package or crafted transaction. No user interaction is required. The exploit executes within the same security scope as the installer service, which runs as SYSTEM during elevated operations. According to the current EPSS data, the probability of exploitation activity is low at the time of publication.
No verified proof-of-concept code is publicly available. See the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-70346
Indicators of Compromise
- Unexpected msiexec.exe child processes spawning shells such as cmd.exe or powershell.exe under SYSTEM
- Crash events for msiexec.exe in the Windows Application event log with access violation exception codes
- Installation of unsigned or unusual .msi packages from user-writable directories such as %TEMP% or %APPDATA%
Detection Strategies
- Monitor Windows Installer service telemetry for abnormal transaction patterns and repeated crashes preceding privilege changes
- Alert on non-administrative users initiating installer operations that yield SYSTEM-level child processes
- Correlate Sysmon Event ID 1 (process create) and Event ID 11 (file create) events involving msiexec.exe with subsequent privilege escalation indicators
Monitoring Recommendations
- Enable command-line auditing (Event ID 4688) and PowerShell script block logging on Windows endpoints
- Ingest Windows Installer log files (msi*.log in %TEMP%) into a central log platform for forensic review
- Track the parent-child process lineage of msiexec.exe to detect anomalous privilege transitions
How to Mitigate CVE-2026-70346
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory to all Windows systems
- Prioritize patching on multi-user systems, terminal servers, and developer workstations where local users can trigger installer actions
- Audit local account membership and reduce standing local logon rights on sensitive hosts
Patch Information
Microsoft has issued a security update for CVE-2026-70346 through the Security Update Guide. Administrators should deploy the patch through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog based on their standard patch management workflow. Consult the Microsoft advisory for the specific KB article corresponding to each affected Windows build.
Workarounds
- Restrict .msi execution from user-writable paths using AppLocker or Windows Defender Application Control policies
- Set the AlwaysInstallElevated policy to disabled (value 0) in both HKLM and HKCU to prevent non-admin users from installing packages with elevated rights
- Limit interactive local logon rights on servers to trusted administrative accounts until patching is complete
# Verify AlwaysInstallElevated is disabled (should return 0 or not exist)
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
# Disable AlwaysInstallElevated if enabled
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
