Windows Installer Elevation Vulnerability in Microsoft Products

CVE-2015-2371

What is CVE-2015-2371?

The Windows Installer service in several versions of Microsoft Windows products is susceptible to an elevation of privilege vulnerability. This flaw allows local users to execute custom action scripts via a crafted .msi package, potentially granting them unauthorized access and increased user privileges on the system. The impacted versions span from Windows Server 2003 to Windows 8.1, indicating a broad exposure to this risk across older and current operating systems. Users are encouraged to apply security updates to mitigate this vulnerability.

References