A use‑after‑free flaw in the Windows Installer component lets an attacker who already has local execution rights create a privileged session, potentially enabling full system compromise. The weakness, identified as CWE‑416, can allow the attacker to gain higher privileges by exploiting memory corruption, thereby violating confidentiality, integrity, and availability. This flaw does not support remote exploitation and requires the attacker to run malicious installer packages on the target machine.

Microsoft Windows 10 and Windows 11 releases from 1607 through 26H2, both x86 and x64 versions, and Microsoft Windows Server 2012 through 2025, including server core installations. All affected editions are explicitly listed on Microsoft’s vulnerability page with the associated cpe identifiers.

The CVSS base score of 7 indicates a high severity for local privilege escalation. The EPSS score is not available, so the current likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, but the impact remains significant for any user with local installation privileges. Inferred attack vectors include local execution of malicious installer files, suggesting that an attacker would need physical or remote access to run an exploit package on the target system.