A race condition arises in Windows Credential Providers when multiple processes share a resource that is not properly synchronized, allowing an authorized local attacker to trigger concurrent execution that results in privilege escalation on the target machine. By manipulating the timing of credential requests, the attacker can obtain elevated local rights and subsequently access or modify protected data, install software, or alter system configurations, thus compromising confidentiality, integrity, and availability of the affected system.

The vulnerability impacts a broad range of Microsoft operating systems. Vulnerable Windows 10 builds include versions 1607, 1809, 21H2, and 22H2. Windows 11 releases from 23H2 through 26H2, as well as the 26H1 build, are affected. Additionally, all major Windows Server iterations—2012, 2012 R2, 2016, 2019, 2022, and 2025—across both full and Server‑Core installations, are also susceptible.

With a CVSS base score of 7.8 the vulnerability is rated high severity, indicating that exploitation would grant significant capabilities to an attacker. The EPSS score is not available, so the current probability of exploitation is uncertain, yet the lack of a KEV listing suggests no public exploit has yet been reported. The attack vector requires a local, authorized user who can initiate credential requests; exploitation would involve inducing a race condition between credential provider instances to gain higher privileges.