A vulnerability in the Microsoft Windows Installer allows an authorized local attacker to elevate their privileges, posing a significant risk of full system compromise.

This vulnerability involves improper input validation within the Windows Installer component. The flaw allows an attacker who already possesses low-level local user privileges to perform actions with elevated system permissions.

Successful exploitation of this vulnerability enables a local attacker to gain full control over the affected system. Given the CVSS score of 7.8, this constitutes a High severity risk that could lead to unauthorized data access, the installation of malicious software, or the complete disruption of system integrity.

Immediate Action: Apply the latest security updates provided by Microsoft via the official MSRC update guide immediately to patch the affected Windows versions.

Proactive Monitoring: Monitor system logs for suspicious process execution patterns or unexpected elevation of privilege events associated with the Windows Installer service.

Compensating Controls: Implement strict principle of least privilege policies for local user accounts to limit the potential impact of a local privilege escalation attempt.

Public Exploit Available: No (exploit_available: unknown)

Organizations should prioritize the deployment of the security updates listed in the Microsoft update guide to mitigate this privilege escalation risk. Failure to patch allows attackers who have gained an initial foothold on a system to escalate their permissions, effectively turning a minor breach into a full system compromise.