A heap-based buffer overflow in Windows Installer can be triggered by an authorized local attacker, allowing that attacker to execute arbitrary code with elevated privileges. If exploited, the attacker could gain full control of the affected machine, compromising confidentiality, integrity, and availability. The flaw arises from inadequate bounds checking when allocating memory, which is captured by CWE-122.

This vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. It also impacts all Windows Server editions from 2012 through 2025, including Server Core installations.

The CVSS score of 7.0 indicates moderate severity, and no EPSS data is currently available. The vulnerability is not listed in the CISA KEV catalog, which suggests limited known exploitation. Attackers must already have authorized local access to trigger the overflow, so the risk is significant in environments where malicious MSI files can be executed but remains confined to systems that lack adequate protection against such packages.