An attacker possessing authorized local user credentials can trigger a use‑after‑free condition in the Windows Installer component. This flaw allows the attacker to execute arbitrary code with elevated system privileges, effectively bypassing normal user restrictions. The weakness is a classic use‑after‑free error (CWE‑416), offering a straightforward path to privilege escalation once the installer process is compromised.

The vulnerability affects a broad range of Microsoft Windows operating systems. According to the vendor information, Windows 10 builds 1607, 1809, 21H2, and 22H2, as well as Windows 11 builds 23H2, 24H2, 25H2, 26H2, 26H1, are affected. Server editions from Windows Server 2012 through Windows Server 2025, including core and standard installations, are also listed as impacted. All affected builds are identified with the corresponding CPE strings in the advisory.

The CVSS score of 7.8 indicates a high severity issue. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an authorized local user and leverages a use‑after‑free condition in the Windows Installer component, enabling the attacker to run arbitrary code with system privileges once the installer is triggered. Because the attack scenario relies on the presence of a local, authorized user and the vulnerability is limited to the installer, mitigations that prevent unauthorized execution of installation packages or restrict user rights can reduce the attack surface.