A use‑after‑free flaw in the Windows Installer component allows an authorized local user to gain higher privileges on the affected machine. This vulnerability is classified as CWE‑416. By exploiting the flaw, an attacker who can run code during the installation process can elevate privilege levels beyond what the original user account permits.

Affected systems are the Microsoft Windows operating systems listed as Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 24H2, 25H2, 26H1; and Windows Server 2012, 2012 Server Core, 2012 R2, 2012 R2 Server Core, 2016, 2016 Server Core, 2019, 2019 Server Core, 2022, 2025, 2025 Server Core. Each of these includes the vulnerable Windows Installer component.

The CVSS score of 7.0 indicates a high severity, but the EPSS score of <1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local and requires an authorized user; remote exploitation would be difficult unless an attacker already controls a local installer process. Until the update is applied, a local attacker can elevate privileges on an affected system.