CVE-2026-59127

This flaw is in Windows Installer, the part of Windows that installs and updates software. Imagine someone who already has an account on your computer using a mistake in Installer’s math to “break out” into a more powerful account. If an attacker can get low-level access on a machine, this bug could help them raise their permissions and do more damage.

This matters if you run the listed Windows 10, Windows 11, and Windows Server versions on computers where an attacker might already have a low-privileged account (for example, a user account that shouldn’t be trusted). The key risk is local: it requires an authorized local attacker with low privileges, and it does not require user interaction. Treat it as relevant when an attacker can get local access to the device (not necessarily admin) and then attempt privilege escalation.

Verdict is RED: this is a local privilege-escalation bug that can turn an already-authorized low-privileged foothold into higher permissions on the same machine. Even though there’s no clear, dated public exploitation report in the provided sources, press attention notes it as a new patch and indicates interest from a major threat actor (Lazarus group), so you should prioritize remediation now.

1. Inventory and scope

   • Identify every device running one of: Windows 10, Windows 11, Windows Server 2012/2012 R2/2016/2019/2022/2025.
   • Confirm whether each device is a workstation or a server; prioritize servers and systems with multiple users.

2. Confirm exposure (practical check)

   • On each device, check the OS version/build (the “10.0.x.x” or “6.2/6.3.x.x” style version shown in system info).
   • If the device is on one of the affected Windows products, compare its build to the fixed versions listed by Microsoft (see below). If it is older than the fixed build for its branch, it’s considered vulnerable.

3. Patch to a fixed build (use the exact fixed version for your OS branch)

   • Windows 10: upgrade to at least 10.0.14393.9418 or 10.0.17763.9121 or 10.0.19044.7663 or 10.0.19045.7663
   • Windows 11: upgrade to at least 10.0.22631.7517 or 10.0.26100.9168 or 10.0.26200.9168 or 10.0.28000.2704
   • Windows Server 2012: upgrade to at least 6.2.9200.26280
   • Windows Server 2012 R2: upgrade to at least 6.3.9600.23338
   • Windows Server 2016: upgrade to at least 10.0.14393.9418
   • Windows Server 2019: upgrade to at least 10.0.17763.9121
   • (Proceed similarly for Windows Server 2022/2025 if/when the corresponding fixed builds are identified in your update channel; the provided fix list includes key fixed builds for several versions, but not explicitly for 2022/2025.)

4. If patching is delayed (temporary risk reduction)

   • Reduce the chance of an “authorized local attacker” scenario by removing unnecessary local user access.
   • Eliminate or tightly control local accounts that are not trusted (especially accounts that can run installers).
   • Ensure the minimum necessary privileges: avoid granting admin rights broadly.

5. What to monitor after updates

   • Review authentication and privilege changes on systems with local user accounts.
   • Watch for unusual installer-related activity from non-admin accounts.

6. Reporting timeline

   • CISA KEV status: not listed in the provided KEV findings, so focus on applying Microsoft’s fixed builds promptly based on your managed update schedule.

CVE-2026-59127 is a Windows Installer privilege escalation issue (CWE-190) driven by an integer overflow/wraparound where Installer calculations exceed their maximum limit, enabling a local attacker to gain higher permissions. Findings characterize the attacker model as an authorized local attacker with low privileges, with no user interaction required.

Exploitation status in the provided sources: no clear dated exploitation claim in news, no public exploit code recorded, and no KEV entry listed. EPSS is provided as a prediction with a flat trend, but since KEV/news do not confirm exploitation here, public-facing exploit likelihood remains based on patch availability and risk assumptions.

Patch availability: fixed OS builds are provided for multiple Windows 10/11 and several Windows Server versions (notably Server 2012/2012 R2/2016/2019). Press attention indicates it is a new patch and associates it with actor interest (Lazarus group), but the provided data does not establish widespread in-the-wild exploitation for this specific CVE.