The vulnerability is a use‑after‑free in the Windows Installer process, enabling an authorized local attacker to gain higher privileges on the target machine. Exploitation requires only local execution of MSI or installer packages, and once the flaw is triggered the attacker can run code with administrative rights. This results in a local privilege escalation scenario, matching CWE‑416, which allows compromised users to take control of the system.

Affected systems include Microsoft Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 to 26H2, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, both in standard and Server Core installations.

The CVSS score of 7.8 indicates moderate severity, and while the EPSS score is not available, the lack of inclusion in the CISA KEV catalog suggests that exploitation may not be widespread yet. The flaw can be exploited when an attacker has the ability to run or craft installer packages, allowing them to elevate their privileges locally to administrative levels, potentially leading to full system compromise.