The vulnerability is a use‑after‑free condition in the Windows Installer component that permits an authorized local user to execute arbitrary code with elevated privileges. Based on the description, it is inferred that remote exploitation is not possible and the flaw requires the attacker to already have legitimate access to the affected system. If the use‑after‑free is successfully triggered, the attacker can run code with system‑level permissions, thereby gaining full control over the host. The weakness is formally identified as CWE‑416.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations. Both x86, x64, and ARM64 architectures are affected as documented in the CPE entries.

The CVSS base score of 7 indicates moderate severity; the EPSS is not available, so the current likelihood of exploitation is unknown. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring an authorized user to initiate privileged installer actions. Given the use‑after‑free nature, an attacker who can execute custom installations or scripts may likely trigger the flaw once the necessary conditions are met.