This vulnerability is a classic use‑after‑free flaw in Windows Installer that permits a local, authorized user to gain elevated privileges on the affected system. The flaw occurs when the installer releases memory while it is still being accessed by a privileged operation. Successfully exploiting this bug allows the attacker to execute code with higher privileges, potentially modifying system files, installing malware, or compromising other user accounts, thereby destroying confidentiality, integrity, and availability of the affected machine.

Affected operating systems include a range of Windows 10 releases (1607, 1809, 21H2, 22H2), multiple Windows 11 releases (23H2, 24H2, 25H2, 26H2, 26H1), as well as Windows Server editions from 2012 to 2025. The specific build numbers and architectural variants are listed in the cognized CPE strings, covering x86, x64, ARM64 and Server Core installations.

The CVSS score of 7.0 indicates a high severity for a local privilege escalation. EPSS data is not available so the probability of exploitation cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is local; an attacker must have legitimate access to the machine and must be able to trigger the installer component, likely through execution of a user‑initiated installation or update. The inability to exploit from remote or without user presence limits widespread impact, but within the local context the damage potential is significant.