The Windows Installer component contains a use‑after‑free condition that allows an internally authenticated user to execute code with elevated privileges. Because the flaw arises when memory that has already been freed is accessed again, a malicious installer or manipulated MSI file can be crafted to trigger the vulnerability and run arbitrary code. This can grant the user full administrative rights on the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2 and their ARM64 builds; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including both full installations and Server Core variants. All affected operating systems share the vulnerable Windows Installer service that processes MSI packages and related install artifacts.

The CVSS score of 7.8 indicates a high‑severity local privilege escalation. The flaw requires an authorized local user, thus it cannot be exploited remotely through the network. The EPSS score is currently unavailable, so an exploitation probability estimate cannot be provided. The vulnerability is not listed in the CISA KEV catalogue, suggesting no publicly known widespread exploitation at this time. Based on the description, it is inferred that the most likely attack vector is a local user executing a malicious installer or MSI file that triggers the use‑after‑free condition. Should an adversary gain a foothold on a target machine, this weakness could be leveraged to elevate privileges to Administrator.