The vulnerability in the Windows Installer exposes sensitive system information to an authorized attacker who can read details locally. This flaw is an improper authorization check, classified as CWE-497, which allows an attacker to discover configuration data, installed software lists, or other privileged information. The impact is a confidentiality breach that can aid future attacks but does not directly affect system integrity or availability.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 across x86, x64, and arm64 platforms; and Microsoft Windows Server releases 2012 through 2025, including Server Core installations, on x64 and the relevant architectures.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting low likelihood of active exploitation. Based on the description, it is inferred that the attack vector is local and requires the attacker to be able to invoke Windows Installer components on the affected system, i.e., to run MSI files with appropriate user privileges. Overall risk remains moderate but limited by the need for local authorized access and the absence of known exploits.