A use‑after‑free defect in Windows Installer allows a local user who can execute a malicious MSI package to obtain higher privileges. A local attacker can trigger the flaw while an installer is running, leading to elevated execution rights. The flaw is a CWE‑416 use‑after‑free condition that can compromise confidentiality, integrity, and availability of the affected system.

The flaw impacts a broad set of Microsoft Windows releases. Affected consumer operating systems include Windows 10 from version 1607 through 22H2 and Windows 11 from versions 23H2, 24H2, 25H2, 26H2, and 26H1. Server editions affected are Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, along with their Server Core installations. The vulnerability also applies to ARM64‑based versions of Windows 11 26H2.

The CVSS base score of 7.0 classifies the vulnerability as high risk, and the absence of an EPSS score indicates it is not known to be actively exploited. The flaw is not listed in the CISA KEV catalog, but it requires an attacker to have local authorized access, which limits the attack surface. Nonetheless, the use‑after‑free nature permits privilege escalation, making the vulnerability a serious concern for environments that allow MSI execution by non‑privileged users.