A NULL pointer dereference flaw in the Windows Installer component enables an attacker who already has local machine access to raise privileges on that system. By triggering the vulnerable code path, the attacker can gain higher privileges, potentially becoming a local administrator and executing arbitrary code with those privileges. The weakness is a classic NULL pointer dereference, defined under CWE‑476, and the impact is confined to the scope of the local system only.

The vulnerability affects multiple Microsoft Windows platforms, including Windows 10 releases 1607, 1809, 21H2, 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). All specified builds are susceptible to this local privilege escalation.

The CVSS score of 7 indicates a high severity for a local vulnerability. Because the exploit requires an attacker to be authenticated to the target machine, the attack vector is local and the potential for widespread exploitation is limited to compromised or temporarily compromised environments. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, which suggests the immediate public exploit risk is moderate but the known severity warrants swift remediation. An attacker could exploit the flaw by executing a crafted installer package or manipulating the Installer service under an authenticated account.