{"id":"CVE-2026-105545","kind":"vulnerability","aliases":["CVE-2026-105545"],"related":[],"title":"Windows Installer: local users can run code with system privileges","description":"An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.\nA locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nThe security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.","summary":"Windows Installer fails to sanitize input, so it loads libraries insecurely. A local user with an account can run arbitrary code with elevated system privileges and then install programs, change or delete data, or create accounts.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","windows-installer"],"not_affected_if":["no-local-accounts","patched-windows"],"how_to_check":"- Check Windows Update for a pending security update to Windows Installer (msi.dll) on each Windows machine.","fix":null,"status":"open","published_at":"2026-11-10T19:17:56+00:00","first_seen_at":"2026-11-10T19:24:19+00:00","triaged_at":"2026-11-10T19:54:06+00:00","updated_at":"2026-11-10T19:54:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:54:06Z","model":"claude-haiku-5-5","output":{"fix":"- The sources say a security update corrects the input sanitization error; the affected Windows versions and fixed build numbers are unknown.","reach":"local","title":"Windows Installer: local users can run code with system privileges","impact":"high","summary":"Windows Installer fails to sanitize input, so it loads libraries insecurely. A local user with an account can run arbitrary code with elevated system privileges and then install programs, change or delete data, or create accounts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user runs code as system administrator","analyst_note":"Find the affected Windows builds and the Microsoft Security Update Guide entry for CVE-2026-105545 to give exact fixed versions.","how_to_check":"- Check Windows Update for a pending security update to Windows Installer (msi.dll) on each Windows machine.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts","patched-windows"],"who_is_affected":"Windows machines where a local account can run the Windows Installer service. The attacker must already be logged in locally, so exposure is mainly on shared or multi-user systems. The sources do not list affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4601,"output_tokens":493,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft Security Update Guide entry for CVE-2026-105545 to give exact fixed versions.","search":"'-105545':13A,16A '-2026':12A,15A 'account':38B,57B,110C 'address':118C 'arbitrari':41B,90C 'attack':87C,97C 'authent':86C 'behavior':83C 'chang':51B,103C 'code':7A,42B,91C 'correct':122C 'could':88C,98C 'creat':56B,108C 'cve':11A,14A 'data':54B,106C 'delet':53B,105C 'elev':44B,59C,93C,130C 'error':126C 'exist':63C 'fail':24B,72C 'full':112C 'infrastructur':17B 'input':27B,76C,124C 'insecur':32B,80C 'instal':2A,21B,23B,49B,67C,71C,100C 'lead':77C 'librari':31B,81C 'load':30B,82C 'local':3A,34B,85C 'new':109C 'preclud':128C 'privileg':10A,46B,61C,95C 'program':50B,101C 'proper':74C 'right':114C 'run':6A,40B,89C 'sanit':26B,75C,125C 'secur':116C 'system':9A,45B,94C 'unintend':129C 'updat':117C 'user':4A,35B,113C 'view':102C 'vulner':62C,120C 'window':1A,18B,20B,22B,66C,70C 'windows-instal':19B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a local account can run the Windows Installer service. The attacker must already be logged in locally, so exposure is mainly on shared or multi-user systems. The sources do not list affected Windows builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-105545':13A,16A '-2026':12A,15A 'code':7A 'cve':11A,14A 'instal':2A 'local':3A 'privileg':10A 'run':6A 'system':9A 'user':4A 'window':1A","search_b":"'account':38B,57B 'arbitrari':41B 'chang':51B 'code':42B 'creat':56B 'data':54B 'delet':53B 'elev':44B 'fail':24B 'infrastructur':17B 'input':27B 'insecur':32B 'instal':21B,23B,49B 'librari':31B 'load':30B 'local':34B 'privileg':46B 'program':50B 'run':40B 'sanit':26B 'system':45B 'user':35B 'window':18B,20B,22B 'windows-instal':19B","search_c":"'account':110C 'address':118C 'arbitrari':90C 'attack':87C,97C 'authent':86C 'behavior':83C 'chang':103C 'code':91C 'correct':122C 'could':88C,98C 'creat':108C 'data':106C 'delet':105C 'elev':59C,93C,130C 'error':126C 'exist':63C 'fail':72C 'full':112C 'input':76C,124C 'insecur':80C 'instal':67C,71C,100C 'lead':77C 'librari':81C 'load':82C 'local':85C 'new':109C 'preclud':128C 'privileg':61C,95C 'program':101C 'proper':74C 'right':114C 'run':89C 'sanit':75C,125C 'secur':116C 'system':94C 'unintend':129C 'updat':117C 'user':113C 'view':102C 'vulner':62C,120C 'window':66C,70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105545","severity":null,"published_at":"2026-11-10T19:17:56+00:00","modified_at":"2026-11-10T19:17:56+00:00","first_seen_at":"2026-11-10T19:24:19+00:00","fetched_at":"2026-11-10T19:24:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}