Heap-based buffer overflow in Windows Installer allows an authorized attacker with a physical presence to elevate privileges. The vulnerability is a classic heap overflow that can be triggered by malicious data during the installer process, granting the attacker elevated rights on the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including both x86, x64 and ARM64 variants as listed in the CPEs.

The CVSS score of 6.6 indicates moderate severity, and the EPSS is not reported, so public exploitation activity is presently unknown. The vulnerability is listed as not in KEV, so it has not yet been identified as widely exploited. Based on the description, it is inferred that the attacker must have local physical access or legitimate user credentials to execute the installer and trigger the overflow. Without such local presence, remote exploitation is not described, making the risk primarily to users who have the ability to run installer packages on the target machine.