CVE-2026-20816CWE-367

CVE-2026-20816

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
2%
Percentile
84.2
In the wild
Unconfirmed
What it is

⚡ A clever timing trick in Windows Installer can let an attacker elevate privileges with just the right conditions! Think of it like a construction site where a worker suddenly swaps blueprints without anyone noticing, allowing them to build whatever they want — that’s how a race condition lets attackers gain unauthorized power! This means an attacker could potentially gain control over system settings, install unwanted software, or even access sensitive data. The ability to elevate privileges locally could lead to devastating consequences if exploited!

Put simply

Think of it like a construction site where a worker suddenly swaps blueprints without anyone noticing, allowing them to build whatever they want — that’s how a race condition lets attackers gain unauthorized power! This vulnerability stems from a time-of-check to time-of-use (TOCTOU) race condition in Windows Installer, where the system fails to properly validate a condition before executing commands, allowing an attacker to manipulate the behavior during that brief window.

What to do

This means an attacker could potentially gain control over system settings, install unwanted software, or even access sensitive data. The ability to elevate privileges locally could lead to devastating consequences if exploited! To protect yourself, apply the latest updates from Microsoft immediately. Also, consider implementing stricter access controls to limit which accounts can execute installers, and always monitor for unusual activity on your systems. You've got this! Follow these steps and your system will be locked down tightly. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02437 · 84.2th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Installer Elevation of Privilege Vulnerability
    cvelistv5