Loading vulnerability…
Windows Installer Incorrect Authorization Privilege Escalation
CVE-2026-105501 is an incorrect authorization vulnerability in Windows Installer that allows a locally authenticated, low-privileged attacker to elevate privileges to SYSTEM. Exploitation requires no user interaction. Microsoft rates the vulnerability Important, assigns a CVSS v3.1 base score of 7.8, and assesses exploitation as more likely. The specific vulnerable function and affected Windows versions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can grant SYSTEM privileges, with high impact to confidentiality, integrity, and availability on the affected system.
Patch, then assume compromise.
Apply the applicable Microsoft security update from the November 10, 2026 release. Consult Microsoft's per-CVE guidance to determine the appropriate update for the installed Windows version and architecture; specific update packages and fixed builds are not identified in the available information.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.