This vulnerability is a stack-based buffer overflow in the Windows Installer component. An authorized user who can supply a crafted installation package can overflow the buffer, corrupt control flow, and gain code‑execution capability with the privileges of the installation process. The flaw is categorized as CWE‑121 and can lead to elevation of privileges on the local machine, allowing a malicious installer to run arbitrary code with elevated rights.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2 (duplicate), as well as all editions of Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score is 7.8, indicating a high severity, while the EPSS score is not available, so the exact exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large-scale exploitation. Attackers would need local access and the ability to execute a malicious MSI; the local nature of the flaw means an attacker who can run installers with user privileges can exploit it, potentially gaining system‑level access if the installer runs with elevated rights.