The vulnerability is a use‑after‑free flaw in Windows Installer that allows a local, authorized attacker to gain elevated privileges. Because the flaw corrupts memory after a sensitive object has been freed, an attacker can influence program control flow and execute arbitrary code. The weakness is identified as CWE‑416.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1 are affected. In addition, all editions of Windows Server from 2012 to 2025, including standard and server‑core installations, are vulnerable.

The flaw carries a CVSS score of 7, indicating a high level of risk. No EPSS data is available, so the current probability of exploitation is uncertain. The issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation is documented yet. The attack vector is local, requiring an authorized user to run a crafted installer or MSI package to trigger the use‑after‑free and achieve privilege escalation.