Improper input validation within Windows Installer can allow an attacker who has authorized local access to elevate their privileges and gain elevated rights, enabling the execution of privileged actions or modification of system settings. The vulnerability stems from unchecked processing of installer arguments or metadata, and is classified as a CWE‑20 (Input validation). As a result, an attacker could compromise the integrity of the affected system and, if successful, take full control of the machine.

The flaw impacts Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2 as well as Windows 11 releases 22H3, 23H2, 24H2, and 25H2. It also affects Windows Server editions, including 2008 R2 SP1 (both Server Core and standard installations), 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition of Server 2022. All of these platforms rely on the same Windows Installer component that contains the vulnerability.

Both the high CVSS score and the inherent nature of local privilege escalation mean that, if exploited, an attacker could gain full control of a vulnerable system, potentially compromising sensitive data and disrupting services. The low EPSS suggests that widespread exploitation is not currently observed, but the inability to contain an attacker once privileged makes the impact severe and immediate patching advisable.