An unpatched vulnerability in the way Windows handles installer files could put systems at risk of attack.