EIP-2026-117514

PRE-CVE

Microsoft Windows - 'MsiAdvertiseProduct' Arbitrary File Copy/Read

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-117514. PoCs published by SandboxEscaper.

AI-analyzed exploit summary The writeup describes a TOCTOU (Time-of-Check Time-of-Use) vulnerability in the 'MsiAdvertiseProduct' function, allowing arbitrary file reads as SYSTEM via junction manipulation. It includes a proof-of-concept tool ('readfile.exe') and a demonstration video link.

Description

Microsoft Windows - 'MsiAdvertiseProduct' Arbitrary File Copy/Read

Exploits (1)

exploitdb WRITEUP

by SandboxEscaper · textlocalwindows

https://www.exploit-db.com/exploits/46040

View Code ZIP pw:eip

The writeup describes a TOCTOU (Time-of-Check Time-of-Use) vulnerability in the 'MsiAdvertiseProduct' function, allowing arbitrary file reads as SYSTEM via junction manipulation. It includes a proof-of-concept tool ('readfile.exe') and a demonstration video link.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Racy

Target: Windows Installer Service (MsiAdvertiseProduct)

No auth needed

Prerequisites: Multi-core system (or timing adjustments for single-core) · Ability to create junctions · Local file system access

MITRE ATT&CK

T1005 - Data from Local System T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 19, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026