CVE-2020-16902

CVE-2020-16902 is an elevation of privilege vulnerability in the Windows Installer, affecting multiple versions of Microsoft Windows and Windows Server. It stems from improper input sanitization, leading to insecure library loading. A locally authenticated attacker could exploit this with low complexity to execute arbitrary code with system privileges, resulting in full compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog and lacking public exploit code in Metasploit or ExploitDB, it has garnered some community discussion and media coverage, including reports of a micropatch.