An authorized local attacker can trigger a use‑after‑free bug within the Windows Installer component. This flaw allows malicious code that runs under the Windows Installer process to run with elevated privileges, effectively bypassing user‑level restrictions and granting the attacker administrative rights on the affected system. The underlying weakness is a use‑after‑free condition (CWE-416), which can lead to arbitrary code execution and compromise the confidentiality, integrity, and availability of the host.

Microsoft Windows operating systems from Windows 10 Series 1607 through 26H2, Windows 11 versions 23H2 to 26H2, and all Windows Server releases from Server 2012 to Server 2025 (including Server Core installations) are vulnerable. The vulnerability applies to both x86 and x64 builds of Windows 10/11 and to ARM64 builds of the newer Windows 11 releases.

The CVSS score of 7 indicates a high severity for local privilege escalation. The EPSS score is less than 1%, implying a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local; an active user, possibly one with limited privileges, must be able to execute a specially crafted MSI package. Once the use‑after‑free condition is triggered, the attacker can run arbitrary code with SYSTEM privileges. Because the flaw resides in a core installer service, exploitation does not require elevated rights at the outset, but the attacker must have the ability to run the installer locally.