A use‑after‑free flaw in Windows Installer can be triggered by an authorized local user to gain elevated privileges. The vulnerability allows the attacker to corrupt memory during installation processing, potentially giving them full administrative rights on the compromised system. The weakness is a classic example of improper memory handling (CWE‑416).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server variants including 2012, 2012 R2 (including Server Core), 2016, 2019, 2022, and 2025. All listed editions regardless of architecture are impacted.

The CVSS score of 7.8 indicates a high severity. No EPSS data is available, but the vulnerability can be exercised by any user who can run an MSI installer locally, meaning the risk to environments with permissive installation policies is significant. The flaw is not listed in CISA's KEV catalog, but the local nature of the attack vector means that systems exposed to local attacker capabilities could be compromised. The use‑after‑free nature suggests that the exploit can be crafted with relative simplicity if the attack surface is accessible.