Microsoft Install Service Elevation of Privilege Vulnerability Exploit (CVE-2026-50343)

Microsoft Install Service grants an interactive standard user write access to plugin configuration beneath HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\State. The service consumes this configuration while running as SYSTEM. The module writes an agent DLL to a publicly readable directory, registers a fresh plugin name in PlugInList and StaticPluginMap, and invokes AppInstallManager.SearchForAllUpdatesAsync(). Install Service then loads the agent DLL as SYSTEM.