The vulnerability arises from a use‑after‑free condition in the Windows Installer component. When an authorized user triggers the free, code execution can occur with the privileges of the installer process, allowing the attacker to gain elevated rights on the local machine. This can lead to full control over the compromised system, enabling installation of malware, tampering with system configuration, and lateral movement within the network. The weakness is CWE‑416: Use‑After‑Free.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012 (standard and Server Core), 2012 R2 (standard and Server Core), 2016 (standard and Server Core), 2019 (standard and Server Core), 2022, 2025 (standard and Server Core). Both x86 and x64 platforms, and ARM64 for selected Windows 11 builds, are affected.

The CVSS v3 score of 7 indicates medium‑to‑high severity for local privilege escalation. The EPSS score is not provided, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers need local authorization and the ability to execute a malicious installer; once that condition is met, the flaw can be abused to elevate privileges. Security teams should treat this as a high‑risk issue for environments that allow local administrative rights or run untrusted installers.