CVE-2026-69605 — Microsoft Install Service Elevation of Privilege Vulnerability
Executive Summary
Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
EPSS Score
No EPSS score available for this CVE.
View on FIRST.orgAffected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 21H2 for 32-bit Systems | 5122878 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for ARM64-based Systems | 5122878 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for x64-based Systems | 5122878 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for 32-bit Systems | 5122878 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for ARM64-based Systems | 5122878 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for x64-based Systems | 5122878 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 23H2 for ARM64-based Systems | 5122880 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 23H2 for x64-based Systems | 5122880 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | 5124008 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5124008 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5124008 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5124008 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | 5124012 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 version 26H1 for x64-based Systems | 5124012 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 | 5122882 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 (Server Core installation) | 5122882 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5122871 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5122871 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5122878 |
Security Update | Yes |
5122880 |
Security Update | Yes |
5124008 |
Security Update | Yes |
5124012 |
Security Update | Yes |
5122882 |
Security Update | Yes |
5122871 |
Security Update | Yes |
Patch Diff
Use-after-free (CWE-416) in the Microsoft Install Service (installservice.dll) update-scan WinRT methods, local elevation of privilege to SYSTEM via a race condition (Important, EoP, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CVSS 7.0; Exploitation More Likely). InstallServiceControl::ScanForAllUpdates and ScanForMultipleUpdates (WinRT methods exposed by the SYSTEM Install Service) return an IVectorView<InstallItem> of scan results to the caller. PRE: the view was produced by wrapping the results in a winrt single_threaded_vector built over a local (single_threaded_vector((vector<InstallItem>*)&local_130) -> GetView(...)) and then releasing that backing (com_ptr::unconditional_release_ref(&local_130)); the returned collection view therefore referenced storage whose lifetime was not tied to the view, so a caller that iterates the returned view while the backing is released/reused reads freed memory - a use-after-free in the SYSTEM process, exploitable by an authorized (medium-privilege) caller who wins the race. Diff of installservice.dll 10.0.26100.9278 -> .9444 (Sep 8 2026, KB5124008, 24H2/25H2) confirms the fix: gated behind CFR flag Feature_1047758136, ScanForAllUpdates/ScanForMultipleUpdates now build the result through a NEW helper CreateReadOnlyInstallItemView<std::vector<winrt::WindowsUpdate::Internal::InstallItem>> - an owned read-only snapshot view - and _Tidy the local vector, instead of returning a view over the released single_threaded_vector backing. When Feature_1047758136 is disabled the original (vulnerable) single_threaded_vector/GetView/unconditional_release_ref path still runs. Confirmation level: the vulnerable functions, the feature gate, and the switch to CreateReadOnlyInstallItemView are cleanly isolable in the diff; the RCA asserts the returned-collection lifetime bug and its fix rather than a fully traced individual free. Note: this Sep-2026 installservice build also carries unrelated WIL feature-reporting churn (FeatureImpl<__WilFeatureTraits_Feature_1047758136> state cache / ReportUsageToService); that infrastructure supports the gate above and is not itself the fix.
| Function | Address | Change | Note |
|---|---|---|---|
winrt::...::InstallServiceControl::ScanForAllUpdates |
code change |
code (returns an owned read-only view instead of a view over released backing, CFR-gated) | Post (Feature_1047758136 enabled): InstallQueue2::CreateScanForAllUpdatesWork(...) then CreateReadOnlyInstallItemView<vector<InstallItem>>(param_1) and _Tidy of the local vector. Disabled/pre: single_threaded_vector((vector<InstallItem>*)&local_130) -> GetView(...) then com_ptr::unconditional_release_ref(&local_130) - returns a view over storage whose backing is released, a dangling collection under a race. |
winrt::...::InstallServiceControl::ScanForMultipleUpdates |
code change |
code (same view-lifetime fix, CFR-gated) | Same Feature_1047758136 gate selecting CreateReadOnlyInstallItemView over the single_threaded_vector/GetView path for the multi-update scan variant. |
CreateReadOnlyInstallItemView<std::vector<winrt::WindowsUpdate::Internal::InstallItem>> |
new function |
added (owned read-only result view) | New helper that builds a read-only IVectorView over an owned copy of the InstallItem results, so the returned collection's lifetime no longer depends on a separately-released single_threaded_vector backing. |
Feature_1047758136 (wil FeatureImpl) |
gate |
added (CFR gate) | wil::details::FeatureImpl<__WilFeatureTraits_Feature_1047758136>::__private_IsEnabled gates the switch to CreateReadOnlyInstallItemView; the original single_threaded_vector path ships when disabled. The associated FeatureImpl state-cache/ReportUsageToService churn in this build is the flag's infrastructure, not the fix. |
Attack Path
The SYSTEM Install Service returns a scan-result collection view over storage it then releases; a racing caller reads it after free
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.