TLDR Tech / InfoSec
Microsoft Windows Installer Folder Delete Privilege Escalation
Exodus Intelligence detailed a logic flaw in the Windows Installer service (msiexec.exe), which runs as SYSTEM, where a low-privileged user chains three COM calls to write an arbitrary folder path into the TempPackages registry key and have the service delete it as SYSTEM, since the cleanup routine never verifies the installer created the folder. Attackers escalate this folder-delete primitive to full SYSTEM code execution by targeting C:\Config.Msi: they recreate it with a permissive DACL, let Windows Installer write rollback scripts there, swap in a malicious .rbs, and trigger a failed install whose rollback executes their payload. Microsoft patched it in April 2025 by adding a feature-flag gate in SetEEUIDirectoryAndFilter() that stops the path from reaching TempPackages, so defenders should confirm MSI patch levels and monitor for non-SYSTEM creation of C:\Config.Msi and untrusted writes to HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages.
Read the full story