PT-2025-32796 · Microsoft · Windows Installer+1

Jagotu · Published 2025-08-12 · Updated 2025-10-30 · CVE-2025-50173

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Installer versions prior to September 2025

Description A weak authentication issue in Windows Installer can allow an authorized attacker to elevate privileges locally. This issue was addressed with a security enhancement in the August 2025 Windows security update (KB5063878) and subsequent updates, fixing the security flaw CVE-2025-50173. However, the August 2025 update inadvertently triggered excessive User Account Control (UAC) prompts for non-admin users during operations like app installations, MSI repairs, and enabling Secure Desktop. The September 2025 update modified the UAC prompt behavior, limiting their necessity for certain operations, specifically MSI repairs, and provided IT administrators with the ability to disable UAC prompts for specific applications via registry keys. The initial fix for CVE-2025-50173 aimed to prevent privilege escalation by attackers, but caused installation problems for non-admin users. The September 2025 update reduces unnecessary UAC prompts for MSI repairs, requiring them only if the MSI file contains elevated custom actions.

Recommendations Install the September 2025 Windows security update to address the UAC prompt issues and the CVE-2025-50173 vulnerability. For IT administrators, utilize the new ability to disable UAC prompts for specific applications by adding specified registry keys.

Fix

LPE

Weakness Enumeration

CWE-1390

Related Identifiers

BDU:2025-10173

CVE-2025-50173

Affected Products

Windows

Windows Installer

References · 19

• https://osv.dev/vulnerability/CVE-2025-50173 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50173 · Security Note
• https://bdu.fstec.ru/vul/2025-10173 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-50173 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50173 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-50173 · Vendor Advisory
• https://twitter.com/Kecemak1Manoj/status/1968542904496046551 · Twitter Post
• https://i.redd.it/n8tzay9ahwnf1.png · Reddit Post
• https://twitter.com/0patch/status/1983863036650602923 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1963606194376806660 · Twitter Post
• https://twitter.com/GameGPU_com/status/1963834337746370935 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1ojxril/micropatches_released_for_windows_installer · Reddit Post
• https://twitter.com/TweetThreatNews/status/1965790569470234861 · Twitter Post
• https://twitter.com/jbhall56/status/1963573083605815470 · Twitter Post
• https://twitter.com/Newtalics/status/1963632930716086423 · Twitter Post