The vulnerability is a heap-based buffer overflow in the Windows Installer component, allowing an authorized local user to gain elevated privileges. Exploiting this flaw requires that the attacker already possesses some level of authorized access on the target system but is able to trigger the buffer overflow to elevate to administrator‑level privileges. The issue maps to CWE‑122 and CWE‑125, indicating that improper buffer management and out‑of‑bounds memory access are core weaknesses. Successful exploitation permits an attacker to execute arbitrary code with higher privileges, potentially compromising the confidentiality, integrity, and availability of system resources.

Microsoft Windows operating systems from Windows 10 version 1607 through 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, are impacted. The flaw also affects a range of Windows Server editions, including Windows Server 2012, 2012 R2, 2016, 2019, 2022, and the upcoming Windows Server 2025, in both full and Server Core installations. All affected builds rely on the Windows Installer service, which is enabled by default on these platforms.

The CVSS base score is 7.8, indicating high severity. EPSS data is not available, so the exploitation probability cannot be quantified, but the lack of a KEV listing suggests no confirmed widespread exploitation. Because the attack vector is local and requires legitimate authorization, the risk is significant for environments with privileged users but lower for restricted or hardened systems. Administrators should treat this as a high‑priority patch event.