The vulnerability resides in the Windows Installer component, where an integer underflow (wrap or wraparound) causes the installer to miscalculate a value used in privilege validation. When triggered by an authorized local user, the underflow allows the installation process to execute actions with elevated rights, effectively granting the attacker system‑level privileges. The fault is classified as CWE-122 and CWE-191. The concern is an escalation of privileges on the local machine, enabling the attacker to install malware or modify system integrity. The impact is limited to local machines and does not expose remote exploitation opportunities according to the description.

Microsoft Windows 10 Version 21H2 and 22H2, Microsoft Windows 11 Versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Microsoft Windows Server 2022 and 2025 (including Server Core). Devices running ARM64 or x64 architectures are affected, as indicated by the associated CPE identifiers. The flaw exists in the installer component of these operating system releases.

The vulnerability has a CVSS score of 7, denoting high severity. The EPSS score is not available, so the current probability of exploitation remains unknown, but the lack of entry in the CISA KEV catalog suggests no widely documented attacks. The likely attack vector involves a local authorized user executing a malicious installer or a compromised application that can run installer processes. Because the flaw requires local privilege and a trusted installer binary, the risk to remote attackers is minimal, but for local users that can run installer commands the threat is significant.