A concurrency flaw in Capability Access Management Service (camsvc) allows a race condition when multiple threads access a shared resource without proper synchronization. The flaw can be exploited by an authorized local user to gain higher privileges than permitted, potentially enabling the execution of arbitrary code with elevated rights.

Microsoft Windows 11 24H2 and 25H2, and Windows Server 2025 (including Server Core installations) are affected.

The vulnerability scores a CVSS of 7, indicating a high impact if exploited. The EPSS score is < 1%, suggesting currently low exploitation probability, and it is not listed in the CISA KEV catalog. Likely, an attacker must have local administrator or domain user permissions and exploit the race condition by triggering concurrent access to camsvc. The attack requires the presence of the service and the deliberate timing of operations, which makes the exploit complex but feasible for a determined local attacker.