CVE-2026-85361

Executive Summary

CVE-2026-85361 is a use-after-free (CWE-416) vulnerability in Windows Installer that allows an authorized local attacker to elevate privileges on affected Windows systems. Successful exploitation requires local access and a low-privileged account, but the resulting compromise yields full confidentiality, integrity, and availability impact at the elevated privilege level. No public proof-of-concept, exploit code, or Nuclei template exists, and the vulnerability remains unpatched according to all tracked sources.

Technical Analysis

The vulnerability resides in the Windows Installer service and is classified as a use-after-free (CWE-416) memory-safety defect. Use-after-free conditions occur when a program continues to reference a heap or pool allocation after that memory has been freed, allowing an attacker who can influence the allocation's lifetime to reclaim the freed region with attacker-controlled data. When the dangling reference is subsequently dereferenced, the program may operate on the attacker-controlled contents, which can corrupt control structures and lead to arbitrary code execution in the security context of the vulnerable process.

In the Windows privilege-escalation context, Windows Installer executes as a system-level service (msiexec.exe / the installer service). A use-after-free within that service's processing path means that an authorized low-privileged local user who can supply crafted input that reaches the flawed code path could cause msiexec to operate on freed memory. If the attacker controls the reclaimed allocation, they may redirect execution to elevate from their low-integrity user token to SYSTEM. The relevant attack surface is the local installer processing handled by the Windows Installer service, which accepts installation packages and related operations invoked by authorized users.

The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the following characteristics. The attack is local (AV:L), meaning the attacker requires local access to the target host. Attack complexity is high (AC:H), consistent with the requirement to win a memory-reuse race or reliably shape heap layout for a use-after-free. Only low privileges are required (PR:L), matching the stated "authorized attacker" model. No user interaction is needed beyond the attacker's own actions (UI:N). The scope is unchanged (S:U), so the vulnerable component and impacted component are the same. Confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), reflecting that successful elevation to a privileged context exposes all system data, permits system modification, and can disrupt system availability.

Insufficient technical detail is available from the NVD description to identify specific functions, code paths, or memory-management constructs within Windows Installer that are involved. The description confirms only the flaw class (use-after-free), the affected component (Windows Installer), the required privilege level, and the impact (local privilege elevation). No CVE Numbering Authority (CNA) title was supplied, no affected version range has been published, and no vendor patch or advisory details are available in the provided data.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the use-after-free vulnerability class and the stated "authorized attacker" privilege model. No specific function names, file paths, or API parameters are invented, because none are provided in the source description.

1. Reconnaissance / target identification: The attacker requires an existing foothold on a targeted Windows host with a valid, low-privileged user account — the CVSS vector's PR:L and AV:L both reflect this. The attacker enumerates the Windows Installer service and its available operations/inputs that an authorized user is permitted to invoke. Because the vulnerability is local, there is no remote scanning step; target identification is simply confirming the presence of a vulnerable Windows Installer build (affected versions are not enumerable from the provided data).

2. Triggering the flaw: Acting as the authorized low-privileged user, the attacker supplies crafted input to the Windows Installer processing path. The use-after-free class requires the attacker to induce the service to free a memory object and then retain and later dereference a dangling pointer to that freed region. The high attack complexity (AC:H) reflects that reliably arranging the free/reuse ordering and heap state is non-trivial. Because no detailed description of the susceptible code path is available, the exact input format cannot be stated here without fabrication.

3. Payload / execution method: At the vulnerability-class level, once the freed allocation is reclaimed with attacker-influenced data, dereferencing the stale pointer can redirect control flow within the Windows Installer service context. The objective is to have that service, which runs with elevated privileges, execute attacker-chosen operations rather than its intended logic. The mechanics of the control-flow redirection are not specified in the available data and are not asserted here.

4. Post-exploitation impact: Successful exploitation elevates the attacker from a low-privileged local user to a higher-privileged context, consistent with the High confidentiality, integrity, and availability scores. At that point the attacker would be positioned to read or alter system-protected data, modify system configuration, install persistence, and disrupt system availability, effectively removing the local privilege boundary on the compromised host.

Impact Assessment

A successful exploit yields local privilege escalation on a Windows host. The CVSS base score is 7.0 (High), with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The confidentiality, integrity, and availability sub-scores are all High, meaning total loss of protection across each of these dimensions within the compromised system context. The scope is Unchanged, so the impact is confined to the same security authority as the vulnerable component rather than crossing a trust boundary to a distinct component.

The blast radius is limited to individual hosts on which the attacker already holds a low-privileged foothold; this is not a wormable or remotely exploitable condition (AV:L, no public exploit). However, on a Windows estate, local privilege escalation from a standard user to an elevated context is a high-value post-exploitation primitive: it converts a contained user-level compromise into a system-level one, enabling credential access, disabling of security controls, and lateral movement as a privileged user. The high attack complexity (AC:H) and the absence of a public exploit, combined with EPSS 0.00252 (15.5th percentile — low predicted exploitation activity) and no CISA KEV listing, indicate that immediate mass exploitation is not currently observed. The primary business risk is therefore an elevated consequence-per-successful-attack for organizations with large numbers of Windows endpoints and multi-user systems, rather than a broad opportunistic campaign.

Detection Guidance

Sigma Rule

title: Potential Windows Installer Use-After-Free Privilege Escalation Activity
id: 3f9c2b74-8a41-4e2d-9b7c-1d5f6a8e2c91
status: experimental
description: Detects suspicious msiexec process behavior consistent with local privilege escalation attempts abusing Windows Installer (CVE-2026-85361).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85361
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_installer:
    Image|endswith: '\msiexec.exe'
  selection_parent:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\explorer.exe'
  selection_flags:
    CommandLine|contains:
      - '/q'
      - '/quiet'
      - '/i'
  condition: selection_installer and selection_parent and selection_flags
falsepositives:
  - Legitimate software deployment via orchestration tools
  - Administrative troubleshooting by helpdesk staff
level: medium

YARA Rule

rule CVE_2026_85361_Windows_Installer_UAF_Artifacts
{
    meta:
        description = "Heuristic detection for suspicious installer payloads associated with Windows Installer local privilege escalation attempts (CVE-2026-85361)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85361"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $mzsig = { 4D 5A }
        $msi = ".msi" ascii wide
        $msiexec = "msiexec" ascii wide nocase
        $uaf_marker = "use-after-free" ascii wide nocase

    condition:
        $mzsig at 0 and filesize < 5MB and ($msi or $msiexec)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"VALTERSIT Possible Windows Installer Exploitation Attempt CVE-2026-85361"; flow:established,to_server; content:"|4d 5a|"; depth:2; content:".msi"; nocase; classtype:attempted-admin; reference:cve,2026-85361; sid:202685361; rev:1;)

Elastic Detection

process where host.os.type == "windows" and
  process.name : "msiexec.exe" and
  process.parent.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe") and
  process.args : ("/q", "/quiet", "/i")

Splunk SPL Query

index=windows source="WinEventLog:Security" EventCode=4688
| search New_Process_Name="*\\msiexec.exe"
| where match(Parent_Process_Name, "(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe)$")
| stats count min(_time) as first_seen max(_time) as last_seen by host, Account_Name, New_Process_Name, Process_Command_Line
| sort - count

Wazuh OSSEC Rule

<group name="windows,privilege_escalation,cve_2026_85361,">
  <rule id="100861" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">msiexec\.exe$</field>
    <field name="win.eventdata.parentImage">(cmd|powershell|wscript|cscript)\.exe$</field>
    <description>Possible Windows Installer privilege escalation attempt (CVE-2026-85361) - suspicious msiexec parent process</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data has been published in the available intelligence.

1. Immediate mitigations:

   • Enforce least privilege: limit the number of users with local interactive logon on Windows endpoints, since exploitation requires an authorized local attacker (PR:L).
   • Restrict who can invoke installer operations and tightly control the distribution of installation packages; treat installer inputs from untrusted or user-writable locations as suspect.
   • Deploy and tune the detection rules above (Sigma/YARA/Suricata/EQL/SPL/Wazuh) to gain visibility into anomalous msiexec activity while awaiting a patch.
   • Harden endpoint monitoring and alerting on unexpected privilege transitions and unusual child processes of the Windows Installer service.
   • Consider application control / allowlisting to prevent execution of untrusted installer payloads.

2. Patch / upgrade steps:

   • No patch is currently available from any tracked source. Monitor Microsoft's Security Update Guide and the Microsoft Security Response Center for an official fix tied to CVE-2026-85361.
   • When a vendor patch is released, test it in a staging environment and then prioritize deployment to high-value and multi-user Windows systems first.

3. Long-term hardening:

   • Maintain a disciplined patch management cycle to rapidly absorb operating-system updates once the fix ships.
   • Reduce standing local privileges and segment hosts so that a single local privilege escalation does not translate to broad lateral movement.
   • Continuously monitor EPSS and CISA KEV status for this CVE, escalating response if exploitation activity or a public exploit emerges.
   • Perform periodic review of installer-related attack surface and disable unnecessary installer functionality where business requirements allow.

References

• NVD — CVE-2026-85361: https://nvd.nist.gov/vuln/detail/CVE-2026-85361
• CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Microsoft Security Update Guide (monitor for future advisory): https://msrc.microsoft.com/update-guide
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85361 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-85361. No threat actor campaigns have been associated with this CVE in the provided data.