Improper privilege management within the Windows Installer component enables an attacker who already has authorized local access to gain elevated privileges, potentially allowing the execution of malicious code with higher Windows security levels. The vulnerability resides in a concurrency control flaw (CWE-362), where race conditions can lead to unauthorized privilege escalation. This flaw has no impact on remote attackers but can be exploited by any user who can trigger an installer operation locally.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core editions. All affected systems run the standard Windows Installer service.

The CVSS score of 7.0 indicates moderate severity. The EPSS score is not available; there is no listing in CISA KEV. The vulnerability requires a local attacker with the ability to trigger Windows Installer processes; no remote exploitation path is documented. Given the local nature, the risk is high for systems that run self‑signed installers or allow users to execute arbitrary MSI packages.