A race condition in the DirectX graphics kernel allows an authorized local user to perform concurrent operations that result in a privilege escalation. The flaw enables a local attacker who already has user access to gain higher privileges, potentially reaching SYSTEM, thereby compromising system confidentiality, integrity, and availability.

Microsoft Windows operating systems including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, and Windows Server editions 2016, 2019, 2022, and 2025, across both standard and server core installations, are affected.

The CVSS score of 7 indicates a high severity, and the EPSS value of less than 1% suggests exploitation is unlikely but not impossible. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is local manipulation of the graphics driver, requiring the attacker to be authenticated but not necessarily privileged. Exploitation involves exploiting the improper synchronization of concurrent operations on shared kernel resources, leading to privilege escalation.