CVE-2026-20816
HighCVSS 7.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
Time-of-check time-of-use (TOCTOU) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker can exploit a race window to gain elevated privileges and compromise system integrity.
Recommendation
Install the latest Windows security updates from Microsoft.
Other vulnerabilities in Windows Installer
See all- CVE-2014-1814High
The vulnerability in Windows Installer allows local users to gain elevated privileges via a crafted application that invokes the repair feature for a different application.
- CVE-2024-38014HighActively exploited
Elevation of privilege vulnerability in Windows Installer. An attacker could exploit it to gain elevated privileges.
- CVE-2026-70347High
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-70346High
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-70345High
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-70344High
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-65774High
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-62768High
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-61938High
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
- CVE-2026-61925High
Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.