Use after free in Windows Installer can be triggered by an authorized local user, allowing the attacker to obtain higher privileges on the affected Windows machine. This flaw is a classic example of a use-after-free bug (CWE‑416) that bypasses normal access controls and can lead to full system compromise. The impact is confined to the local machine as the attacker must first authenticate with a standard user account.

The vulnerability affects multiple Windows releases: several Windows 10 builds (1607, 1809, 21H2, 22H2), Windows 11 versions (23H2, 24H2, 25H2, 26H2, 26H1), as well as Windows Server 2012 through 2025 – including both standard and Server Core installations. All listed builds run on x86, x64, ARM64 processors, and are present in the provided CPE list.

With a CVSS score of 7, this flaw is considered high severity. The EPSS value is unavailable, so the current likelihood of exploitation cannot be quantified, and it is not listed in the CISA KEV catalog. The attack requires local access and an authorized user account, which limits the threat surface but still presents a critical risk on unpatched systems. If exploited, the attacker could gain administrative rights, install malware, or disrupt services.