A heap-based buffer overflow in Windows Installer can be triggered by an authorized local user, allowing that user to gain elevated privileges on the affected system. The vulnerability arises from insufficient bounds checking when processing installer data, permitting an attacker to corrupt memory and execute arbitrary code. This flaw provides a straightforward path for privilege escalation, granting a user administrative capabilities on the machine.

Affected Microsoft Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and the corresponding 23H2. All current releases of Windows Server from 2012 through 2025 and 2025 core installations are also vulnerable, spanning 2012 (both standard and server core), 2012 R2, 2016, 2019, 2022, 2025, and the related server core variants.

The CVSS score of 7.8 indicates a high severity level, though the EPSS score is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is listed as not included in CISA KEV, suggesting no documented widespread exploitation. The attack vector is local; an attacker who can run code on the machine can launch the exploit by crafting a malicious installer package or corrupting an existing one. Once executed, the attacker can gain administrative rights, enabling them to install software, modify configurations, or compromise other users.