Microsoft Windows: Local privilege escalation via unsigned MSIX codec (CVE-2026-97799, CVE-2026-116714)

An exploit chain has been published involving CVE-2026-97799 and CVE-2026-116714. The vulnerability allows an attacker with local access to bypass Windows AppX content checks by deploying a specially crafted, unsigned MSIX codec package. The Windows audio engine process (audiodg.exe) subsequently loads an attacker-supplied DLL. Due to insecure DACL configurations in a Microsoft-shipped service, this facilitates escalation from the LOCAL SERVICE context to SYSTEM.

Attack Chain

1. Attacker crafts an unsigned MSIX codec package containing a malicious DLL.
2. The package is deployed to the target system.
3. The MSIX package bypasses standard AppX signature and content validation checks.
4. The Windows audio engine process (audiodg.exe) loads the attacker-provided DLL.
5. The DLL executes in the context of the LOCAL SERVICE account.
6. The attacker leverages a service DACL misconfiguration to escalate privileges from LOCAL SERVICE to SYSTEM.

Recommendation

• Review the Microsoft Security Update Guide for CVE-2026-97799 and CVE-2026-116714 to identify affected Windows builds.
• Apply the relevant security patches for both CVEs immediately to address the service DACL misconfiguration and the MSIX validation bypass.
• Inventory systems with custom codec packages installed via MSIX to identify potential indicators of unauthorized modification.