The vulnerability involves a use‑after‑free condition in the Windows Installer subsystem. An attacker with local authorization can trigger a memory reuse error that allows them to run code with higher privileges, effectively elevating them to administrator rights. This flaw is classified as CWE‑416 and can compromise the confidentiality, integrity, and availability of the affected system if exploited successfully.

All of the listed Microsoft Windows operating systems are impacted, including Windows 10 from version 1607 through 22H2, Windows 11 from version 23H2 through 26H2 (for both x64 and arm64 architectures), and Windows Server editions ranging from 2012 to 2025 (including both standard and server core installations).

With a CVSS score of 7, the vulnerability is of medium‑to‑high severity. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalog, indicating that widespread exploitation is not yet documented. The threat vector is inferred to be local: an attacker must have some level of authorized access, though elevated privileges can then be achieved. The risk is elevated in environments where users operate with more than minimum privileges or where the Windows Installer service is exposed to untrusted inputs.