Executive Summary
CVE-2025-27727 is a critical logic vulnerability in the Microsoft Windows Installer (msiexec.exe) that allows a low-privileged local attacker to elevate privileges to NT AUTHORITY\SYSTEM. The flaw exists in the service's handling of temporary packages, where the CMsiConfigurationManager COM interface fails to validate whether a folder scheduled for deletion was actually created by the installer service. By registering an arbitrary folder path in the TempPackages registry key, an attacker can force the SYSTEM-level service to delete it.
Technically, the attack is chained by exploiting an 'access check at open-time' weakness. After using the arbitrary delete primitive to clear the C:\Config.Msi folder, an attacker recreates the folder with a NULL DACL. By maintaining a handle with WRITE_DAC permissions opened while the folder was permissive, the attacker can later overwrite the security descriptors applied by the legitimate installer, swap legitimate rollback scripts (.rbs) with malicious payloads, and trigger a rollback that executes the payload as SYSTEM. This vulnerability was addressed in the April 2025 Patch Tuesday update.