A race condition exists when multiple instances of Windows Shell access a shared resource without proper synchronization, allowing an authorized attacker to gain elevated privileges on the local machine. This flaw is mapped to CWE-362, which involves concurrent execution using a shared resource with improper synchronization. The attacker must already have a user account with rights to run the shell, but can obtain administrative privileges or other elevated rights that are normally restricted.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2 and 25H2; Microsoft Windows Server 2019, Windows Server 2022 (including 23H2 edition and Server Core installation) and Windows Server 2025 (including Server Core installation). These are the only documented affected releases.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% reflects a very low but nonzero probability of exploitation in the wild. The vulnerability is only exploitable from a local session by a user with permission to launch Windows Explorer or the shell, without requiring network access. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so no public exploit is known, but the high impact warrants prompt remediation.