The vulnerability stems from improper handling of insufficient permissions in the Windows Installer, allowing a user with the ability to run MSI installers to obtain elevated privileges. This flaw is classified as CWE‑280 and is observable only on systems where the attacker has local access and can execute privileged installation packages. When successfully exploited, the attacker can gain administrator or system-level rights, enabling arbitrary code execution, data modification, or further lateral movement.

The flaw compromises a wide range of Microsoft Windows client and server operating systems. On Windows 10, versions 1607, 1809, 21H2 and 22H2 are affected, as well as Windows 11 editions 23H2, 24H2, 25H2, 26H1, and 22H3. The vulnerability also impacts Windows Server releases from 2012 through 2025, including both full and Server Core installations. Supported processor architectures include x86, x64, and ARM variants.

The CVSS score of 7.8 marks this as a high‑risk local privilege escalation. The attack vector remains local; an authenticated user with the ability to run MSI files is required to trigger the exploit. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. If exploited, the attacker can elevate privileges to take full control of the machine, compromising confidentiality, integrity, and availability across the impacted environment.