CVE-2021-41379

Think of Windows Installer as a helper that installs software with the power it needs to make changes. This bug is like a shortcut a low-privileged person could use locally to trick the installer into doing tasks with higher privileges. That can help attackers fully compromise a computer and then deploy ransomware or steal data.

This matters if you run the affected Microsoft Windows products (Windows 10/11, Windows 7/8.1/RT 8.1, and common Windows Server versions). Because it requires low-privileged local access, it’s most relevant to workplaces where untrusted users can log on to machines or where an attacker has already gained a foothold.
It’s a real risk when an attacker can reach the machine as a local (low-privilege) user; the threat is confirmed in ransomware activity listed by CISA.

This is RED because it’s confirmed in CISA’s Known Exploited Vulnerabilities list and has been used in ransomware campaigns. Attackers actively look for ways to escalate from limited access to full control, and this Windows Installer weakness is one of those paths.