A heap-based buffer overflow in Windows Installer permits an authorized local attacker to elevate their privileges, potentially to administrator level, by abusing memory corruption. This weakness, classified as CWE‑122, can enable the attacker to gain unintended system control and execute arbitrary code with elevated rights.

The vulnerability affects a wide range of Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1, as well as Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025—including their Server Core installations.

With a CVSS score of 7.8 the issue carries a moderate‑to‑high severity, and although an EPSS score is not available, the lack of exploitation data does not diminish the potential risk. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been identified as a known exploited vulnerability. Likely attack conditions require the attacker to have local system access and the ability to install or invoke Windows Installer, after which the memory corruption can be triggered to elevate privileges.