CVE-2026-70347: Windows Installer Privilege Escalation Flaw

CVE-2026-70347 Overview

CVE-2026-70347 is a heap-based buffer overflow in Windows Installer that allows an authorized local attacker to elevate privileges. The flaw is tracked under CWE-122 and carries a CVSS 3.1 base score of 7.8. Successful exploitation grants an attacker elevated privileges on the affected host, with full impact to confidentiality, integrity, and availability. Microsoft published the advisory on 2026-08-11 through the Microsoft Security Response Center. No public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A low-privileged local user can trigger memory corruption in Windows Installer to execute code with SYSTEM-level privileges, enabling full host compromise.

Affected Products

Microsoft Windows (Windows Installer component)
Refer to the Microsoft Security Update CVE-2026-70347 advisory for the authoritative list of affected Windows versions and build numbers

Discovery Timeline

2026-08-11 - CVE-2026-70347 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-70347

Vulnerability Analysis

CVE-2026-70347 is a heap-based buffer overflow in the Windows Installer service (msiexec.exe / msi.dll). Windows Installer runs with SYSTEM privileges to process .msi packages and transforms, which makes memory corruption in its parsing and installation logic a direct path to local privilege escalation. An authorized attacker who can invoke installer operations can supply crafted input that exceeds an allocated heap buffer, corrupting adjacent heap metadata or object pointers.

The attack requires local access and low privileges but no user interaction. This aligns with common Windows Installer elevation-of-privilege patterns where an unprivileged user coerces the elevated installer service to act on attacker-controlled data. According to EPSS data from 2026-08-13, active exploitation probability is currently low, but heap corruption bugs in installer components historically become reliable local privilege escalation primitives once analyzed.

Root Cause

The root cause is improper validation of buffer sizes prior to a heap write inside Windows Installer, categorized as [CWE-122: Heap-based Buffer Overflow]. Attacker-controlled length or offset values are used to write into a heap allocation without sufficient bounds checking. Microsoft has not published component-level technical details beyond the advisory.

Attack Vector

The attack vector is local. An attacker authenticated on the target host invokes Windows Installer operations, such as installing, repairing, or advertising a crafted .msi package, or interacting with the installer through documented COM interfaces. The malformed package or parameter triggers the overflow inside the elevated installer process, resulting in code execution or token manipulation in the SYSTEM context.

No verified exploit code is available. Technical specifics are described in prose only; consult the Microsoft Security Update CVE-2026-70347 advisory for vendor guidance.

Detection Methods for CVE-2026-70347

Indicators of Compromise

Unexpected msiexec.exe executions spawned by unprivileged user processes, especially with non-standard command-line arguments referencing local or temporary .msi or .mst files
Crashes or Windows Error Reporting entries for msiexec.exe or msi.dll with heap corruption exception codes such as 0xC0000374 or 0xC0000005
New SYSTEM-context child processes descending from a Windows Installer invocation initiated by a standard user

Detection Strategies

Alert on msiexec.exe child processes that launch interactive shells (cmd.exe, powershell.exe) or LOLBins from a SYSTEM token when the parent was triggered by a non-administrator user
Correlate Application event log crashes in msiexec.exe with subsequent privilege-escalation behavior on the same host within a short time window
Hunt for .msi files written to user-writable directories (%TEMP%, %APPDATA%) that are then invoked with elevation flags

Monitoring Recommendations

Ingest Sysmon Event IDs 1 (Process Create), 11 (File Create), and 15 (FileCreateStreamHash) into your SIEM and pivot on msiexec.exe activity
Track Windows Installer event log source (MsiInstaller) for repeated failed install attempts preceding unusual process activity
Baseline normal software deployment flows so that ad-hoc .msi execution by end users generates high-fidelity alerts

How to Mitigate CVE-2026-70347

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-70347 advisory to all Windows endpoints and servers
Prioritize patching on multi-user systems, terminal servers, and jump hosts where local unprivileged accounts are common
Audit which local users can execute msiexec.exe and restrict interactive logon on sensitive systems

Patch Information

Microsoft released the security update on 2026-08-11. Deploy the applicable cumulative or standalone update for each supported Windows version through Windows Update, WSUS, Microsoft Update Catalog, or your enterprise patch management tooling. Verify installation by confirming the updated build number after reboot.

Workarounds

Disable the Windows Installer service on systems that do not require software installation, understanding this will block legitimate MSI-based deployments
Set the AlwaysInstallElevated policy to 0 in both HKLM and HKCU to prevent standard users from installing packages with elevated privileges
Restrict write access to directories used for staging installer packages and enforce application control (WDAC or AppLocker) rules that block execution of unsigned .msi files

bash

# Verify AlwaysInstallElevated is disabled (both keys must be 0)
reg query "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated

# Enforce disabled state via policy
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f