CVE-2020-0683

What is Windows Installer?

Windows Installer (msiexec.exe) is the built-in service that runs on every Windows machine to install, repair, and remove software packaged as MSI files. Because installation routines routinely need to write to protected system directories and the registry, Windows Installer operations run with elevated privileges — making the component a long-standing target for privilege escalation research whenever its rollback or file-handling logic can be tricked into touching files an ordinary user shouldn't be able to reach.

Overview

CVE-2020-0683 is a privilege escalation vulnerability in how Windows Installer processes MSI packages that make use of symbolic links (or similar filesystem reparse points). By crafting an MSI package — or manipulating the installer's rollback/temp file handling — with a symbolic link pointing at a protected location, a low-privileged local user can trick the elevated Windows Installer service into writing to, overwriting, or deleting files it should not have access to, ultimately gaining SYSTEM-level control of the host.

Technical Details

This is a classic instance of the symbolic-link/race-condition class of privilege escalation bug (CWE-59-style link-following issue), where a privileged process follows a filesystem link controlled by an unprivileged user instead of validating the target first. Windows Installer's rollback mechanism — which restores files if an install is interrupted or fails — has historically been a rich source of such bugs because it performs privileged file operations based on paths that can be influenced by the invoking, lower-privileged user. The CVSS vector (AV:L/AC:L/PR:L/UI:N) reflects that exploitation requires only local access with some existing privileges, no user interaction, and low complexity — consistent with a reliable, scriptable local exploit rather than a fragile memory-corruption primitive.

Discovery

Addressed through Microsoft's routine security update process as part of the February 2020 Patch Tuesday cycle; no independent researcher is publicly credited for this specific CVE.

Exploitation Context

CISA's KEV catalog listing confirms real-world exploitation of this vulnerability. Windows Installer privilege escalation bugs are attractive to attackers and red teams alike because Windows Installer is present and enabled by default on virtually every Windows system, giving a nearly universal local-to-SYSTEM escalation path once initial code execution is achieved — making it a natural fit for post-exploitation toolchains used after phishing or other initial-access techniques.

Remediation

1. Apply the February 2020 Windows security update (or any later cumulative update) across all affected systems.
2. Restrict local logon rights and monitor for unusual MSI installation activity from non-administrative accounts.
3. Use application allowlisting or installer restriction policies to limit which MSI packages can be executed on sensitive systems.
4. Ensure endpoint detection tooling flags anomalous privilege escalation attempts tied to msiexec.exe.
5. Audit systems for signs of exploitation predating patch deployment, particularly unexpected SYSTEM-level file writes correlated with installer activity.