Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network. This vulnerability is a classic data authenticity failure (CWE-345). The primary impact is the ability to impersonate legitimate app installers, undermining trust in update delivery.

The affected products are Microsoft Windows App Client for Windows Desktop. No specific version information is supplied, meaning all current installations of this product may be vulnerable until a vendor update is applied.

CVSS score 5.9 indicates moderate severity. EPSS score is less than 1%, suggesting low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network-based spoofing of installation data, but no detailed exploitation path is disclosed.