A use‑after‑free flaw in Windows Installer allows an authorized local user to run privileged code after the installer service frees an object that is still being referenced. The vulnerability can be exploited only by attackers who already have temporary elevated privileges or who can run a malicious MSI package, but once triggered it grants them full system control. The weakness is classified as CWE‑416 and carries a CVSS score of 7, indicating a moderate‑to‑high severity for potential impact on confidentiality, integrity and availability of the affected system.

This flaw affects all supported Windows 10 releases from version 1607 to 22H2, Windows 11 releases from 23H2 to 26H2 (including the 26H1 build), and all Windows Server editions from 2012 through 2025, including their Server Core installations. The list also covers ARM64 and x64 variants listed in the CPE data. Systems running any of these operating systems without the latest cumulative update are vulnerable.

The CVSS score of 7 suggests that exploitation would be considered high in impact but requires local attacker foothold; the EPSS score is not available, so no quantified likelihood can be stated. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would typically trigger the flaw by installing a crafted MSI package while possessing the required privileges to write to the Windows Installer object pool or by executing a local installer under a privileged account. If successful, the attacker can create or modify system settings, install software, or otherwise obtain full control of the machine.