This vulnerability is a use‑after‑free flaw in Windows Installer that allows an authorized local attacker to gain elevated privileges. When the flaw is triggered, the installer’s memory management fault can be exploited to execute arbitrary code or elevate the attacker’s permissions, potentially enabling full system control depending on the attacker’s initial access level. The weakness aligns with CWE‑416, indicating that freed memory is accessed again, a classic pattern for privilege‑escalation exploits.

Affected Microsoft operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and all Windows Server releases from Server 2012 up to Server 2025, including core installations. All these versions lack the mitigation that later releases incorporate.

The CVSS score of 7.0 indicates a moderate severity for local attacks, while the EPSS score is not available, preventing a precise probability assessment. The vulnerability is not listed in the CISA KEV catalog, suggesting no known broad exploitation campaigns. The primary attack vector requires a local, authenticated user who can supply or influence installer input; an attacker would need to craft or modify installer packages or relate operations to trigger the use‑after‑free scenario.