The vulnerability is a heap‑based buffer overflow in Windows Installer that can be triggered by a user with local privileges. When an authorised attacker causes the defect to execute, the overflowing write corrupts adjacent memory on the heap, causing the installer to perform operations that could lead to higher privileges. Based on the description, it is inferred that this memory corruption may allow the attacker to manipulate code paths and ultimately gain higher privileges on the affected machine. The flaw is classified as CWE‑122, indicating that an unchecked buffer overrun can lead to arbitrary code execution and privilege escalation.

This flaw affects Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1. It also impacts the Windows Server family, covering Server 2012 (full and core), Server 2012 R2 (full and core), Server 2016, Server 2019, Server 2022, and Server 2025.

The CVSS score of 7.8 classifies the issue as high severity. The vulnerability is only exploitable from a local workstation, so an attacker must already have a local account on the machine. The EPSS score is less than 1%, indicating a very low estimated probability of exploitation, and the lack of a KEV listing suggests no widespread exploitation has been publicly reported. In practice, it is inferred that an attacker could attempt to craft or abuse a malicious MSI installation that triggers the overflow during the installer’s heap allocation. Successful exploitation would grant the attacker the same privileges as the installer process.