The vulnerability is an out‑of‑bounds read in the Windows Installer component. An attacker who can run privileged code on the target machine can trigger the error and read memory that was not intended to be exposed, exposing sensitive data stored by the installer. The weakness is classified as CWE‑125: Out‑of‑Bounds Read. This results in a local information disclosure that can compromise confidentiality of files, registry values, or other protected data on the host.

The flaw affects Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions from 2012 through 2025. The affected builds include x86, x64, and ARM64 architectures as listed in the CPE data.

The base CVSS score of 5.5 indicates moderately high risk, and while no EPSS score is published, the lack of a KEV listing suggests exploitation has not been observed at scale. The required conditions are local execution with sufficient authority to run the Windows Installer, meaning an adversary needs at least administrative or privileged user access. Once the condition is satisfied, the flaw can be exploited to expose sensitive data but does not lead to code execution or system compromise.