CVE-2026-59127: Windows Installer Elevation of Privilege Vulnerability

CSIRTS triage

What

Integer overflow in Windows Installer allows local privilege escalation.

Who is affected

Authorized attackers on systems running Windows Installer.

Urgency

High severity (CVSS 7.8); not currently exploited but requires local access.

Action

Apply Microsoft security updates for Windows Installer when available.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Microsoft Security Response Center (INTL · vendor-psirt · site)

Severity

high — CVSS 7.8

Published

2026-08-11

Exploitation

Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59127

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-591270.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• critical[NEW] [critical] Microsoft Windows Products: Multiple vulnerabilitiescert-bund
• unknownexploitedNCSC-2026-0284 [1.00] [M/H] Vulnerabilities patched in Microsoft Windowsncsc-nl
• highCVE-2026-59127: Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate p…nvd