Abstract

Since Windows Vista, TrustedInstaller has served as a privileged core of the Windows servicing stack, supporting system updates, feature management, component repair, and the protection of critical files and registry state. Despite its extensive privileges, its internal architecture and security boundaries have received limited public analysis.

In this talk, we present what we believe is the first end-to-end public analysis of TrustedInstaller. We uncover its undocumented architecture, execution model, and trust boundaries across the Windows servicing stack. We also show how cross-component reverse engineering enabled us to connect fragmented evidence across multiple binaries and identify previously hidden attack surfaces.

Building on this analysis, we disclose a previously unknown local privilege-escalation vulnerability, CVE-2026-61938, a use-after-free vulnerability in the TrustedInstaller service that can lead to SYSTEM privileges. Beyond this vulnerability, we introduce TrustFall, another new attack technique that turns previously unreported attack surfaces in TrustedInstaller into a powerful primitive for local privilege escalation under default Windows configurations. We will demonstrate TrustFall and its security implications during the talk.