{"id":"CVE-2026-105507","kind":"vulnerability","aliases":["CVE-2026-105507"],"related":[],"title":"Windows Installer: flawed input handling lets a local user gain system rights","description":"An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.\nA locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nThe security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.","summary":"Windows Installer fails to sanitize input, which leads to insecure library loading. A locally logged-in attacker can run arbitrary code with elevated system privileges and then install programs, change or delete data, or create accounts with full rights.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","windows-installer"],"not_affected_if":["no-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:49+00:00","first_seen_at":"2026-11-10T19:24:15+00:00","triaged_at":"2026-11-10T19:42:38+00:00","updated_at":"2026-11-10T19:42:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: flawed input handling lets a local user gain system rights","impact":"high","summary":"Windows Installer fails to sanitize input, which leads to insecure library loading. A locally logged-in attacker can run arbitrary code with elevated system privileges and then install programs, change or delete data, or create accounts with full rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user runs code as SYSTEM, creating accounts and altering data","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105507 to get affected Windows builds, the fixed update and any check method.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine where a person can sign in locally can be exposed, since the attacker must already have a local account. The sources do not name affected Windows builds or the update's identifier, so the exact versions are unknown. Systems where only trusted administrators sign in are at lower practical risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4601,"output_tokens":464,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105507 to get affected Windows builds, the fixed update and any check method.","search":"'-105507':15A,18A '-2026':14A,17A 'account':60B,116C 'address':124C 'arbitrari':44B,96C 'attack':41B,93C,103C 'authent':92C 'behavior':89C 'chang':54B,109C 'code':45B,97C 'correct':128C 'could':94C,104C 'creat':59B,114C 'cve':13A,16A 'data':57B,112C 'delet':56B,111C 'elev':47B,65C,99C,136C 'error':132C 'exist':69C 'fail':26B,78C 'flaw':3A 'full':62B,118C 'gain':10A 'handl':5A 'infrastructur':19B 'input':4A,29B,82C,130C 'insecur':33B,86C 'instal':2A,23B,25B,52B,73C,77C,106C 'lead':31B,83C 'let':6A 'librari':34B,87C 'load':35B,88C 'local':8A,37B,91C 'log':39B 'logged-in':38B 'new':115C 'preclud':134C 'privileg':49B,67C,101C 'program':53B,107C 'proper':80C 'right':12A,63B,120C 'run':43B,95C 'sanit':28B,81C,131C 'secur':122C 'system':11A,48B,100C 'unintend':135C 'updat':123C 'user':9A,119C 'view':108C 'vulner':68C,126C 'window':1A,20B,22B,24B,72C,76C 'windows-instal':21B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a person can sign in locally can be exposed, since the attacker must already have a local account. The sources do not name affected Windows builds or the update's identifier, so the exact versions are unknown. Systems where only trusted administrators sign in are at lower practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-105507':15A,18A '-2026':14A,17A 'cve':13A,16A 'flaw':3A 'gain':10A 'handl':5A 'input':4A 'instal':2A 'let':6A 'local':8A 'right':12A 'system':11A 'user':9A 'window':1A","search_b":"'account':60B 'arbitrari':44B 'attack':41B 'chang':54B 'code':45B 'creat':59B 'data':57B 'delet':56B 'elev':47B 'fail':26B 'full':62B 'infrastructur':19B 'input':29B 'insecur':33B 'instal':23B,25B,52B 'lead':31B 'librari':34B 'load':35B 'local':37B 'log':39B 'logged-in':38B 'privileg':49B 'program':53B 'right':63B 'run':43B 'sanit':28B 'system':48B 'window':20B,22B,24B 'windows-instal':21B","search_c":"'account':116C 'address':124C 'arbitrari':96C 'attack':93C,103C 'authent':92C 'behavior':89C 'chang':109C 'code':97C 'correct':128C 'could':94C,104C 'creat':114C 'data':112C 'delet':111C 'elev':65C,99C,136C 'error':132C 'exist':69C 'fail':78C 'full':118C 'input':82C,130C 'insecur':86C 'instal':73C,77C,106C 'lead':83C 'librari':87C 'load':88C 'local':91C 'new':115C 'preclud':134C 'privileg':67C,101C 'program':107C 'proper':80C 'right':120C 'run':95C 'sanit':81C,131C 'secur':122C 'system':100C 'unintend':135C 'updat':123C 'user':119C 'view':108C 'vulner':68C,126C 'window':72C,76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105507","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105507","severity":null,"published_at":"2026-11-10T19:17:49+00:00","modified_at":"2026-11-10T19:17:49+00:00","first_seen_at":"2026-11-10T19:24:15+00:00","fetched_at":"2026-11-10T19:24:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}