Add CVE-2026-50343 (InstallService) check

[KenjiEndo15]

Hi!
I wrote this PR for testing CVE-2026-50343.

In Brief

InstallService is a Windows service that manages Microsoft Store app installations and updates. The service can load plugins and execute them. To perform these actions, it reads registry keys:

• PluginInList: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\PlugInList
  List of plugins to load

• StaticPluginMap: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\StaticPluginMap
  Where each plugin's DLL is

When InstallService starts or checks for updates, it:

1. Reads the registry keys (they may not exist by default.)
2. For each plugin listed, loads the DLL from the path specified
3. Runs that DLL code as SYSTEM

PrivescCheck

I found verifying write permissions via ACL analysis complex. Instead, the check attempts to create the required subkeys (PlugInList and StaticPluginMap) under HKLM\...\InstallService\State​ and write test values to them. If successful, the vulnerability exists. Any subkeys or entries created during testing are removed afterward to leave the system unchanged.

Windows Build

Researchers say the CVE affects Windows 11. That said, I was able to write to the relevant subkeys on Windows 10, but the exploit did not succeed. This makes me wonder whether there might be a way to adapt the exploit so that the CVE could also be triggered on Windows 10.

References

• https://blog.calif.io/p/dark-elevator-windows-install-service
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50343