What happened
CVE-2026-105545 is an elevation of privilege vulnerability in the Windows Installer. Improper input sanitisation can lead to insecure library loading. A locally authenticated attacker with a low-privileged account could run arbitrary code with elevated system privileges; no action from another user is required. The attacker could then install programmes, view, change or delete data, or create accounts with full user rights. The reported severity is high, with an NVD score of 7.0. NVD analysis is still in progress, so the scope may change. A fix is available; organisations should apply it and check the vendor advisory for the applicable fixed versions.
Who is affected
Affected deployments are the following Windows versions and architectures, within the stated version ranges:
Windows 10 Version 1607, 32-bit and x64: 10.0.14393.0 to before 10.0.14393.9612 Windows 10 Version 1809, 32-bit and x64: 10.0.17763.0 to before 10.0.17763.9376 Windows 10 Version 21H2, 32-bit, ARM64 and x64: 10.0.19044.0 to before 10.0.19044.7807 Windows 10 Version 22H2, 32-bit, ARM64 and x64: 10.0.19045.0 to before 10.0.19045.7807 Windows 11 Version 23H2, ARM64 and x64: 10.0.22631.0 to before 10.0.22631.7652
Recommended actions
- Apply the available vendor fix to affected deployments, and check the vendor advisory for applicable fixed versions.
- Restrict local access to affected devices to authorised users, because exploitation requires access to the host.
- Review and minimise low-privileged account access on affected devices to reduce opportunities for a locally present attacker.
- Monitor endpoint activity for unexpected programme installations, changes to data, new accounts, and activity involving elevated system privileges.
