The Windows Installer use‑after‑free flaw allows an attacker who can run code under the installer process—such as by installing a crafted MSI package—to exploit a memory‑management bug that can lead to privilege escalation. Once the vulnerability is triggered, the attacker can gain local administrative rights, effectively turning a non‑elevated user into a full administrator. The weakness is classified as CWE‑416 and follows the typical pattern of memory corruption where an object is freed and an attacker later uses a stale reference to it.

Microsoft has identified the issue in several Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core). All of these builds are affected according to the CNA vendor product list; no further version granularity is provided in the public information.

The flaw carries a CVSS score of 7, indicating medium‑to‑high severity. No EPSS score is currently published, but the vulnerability is listed as not included in the CISA KEV catalog. Attackers need local access to run an installer, so the attack vector is local and requires the ability to execute a malicious MSI file. If the exploit succeeds, it can elevate a standard user to the privileges of the installer process, which typically includes administrator rights on that machine. Because the vulnerability exists only in the installer component, it is not exploitable remotely, and the required conditions are relatively straightforward for a user who can place files on the system.