A race condition in the Tablet Windows User Interface (TWINUI) Subsystem allows an authorized local user to exploit improper synchronization of a shared resource. This flaw can be leveraged to gain higher privileges on the affected system, compromising confidentiality, integrity, and availability of the workstation or server. The weakness is a classic concurrency flaw, classified as CWE-362.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Microsoft Windows Server 2016, 2019, 2022, 2025, and their respective Server Core installations are all affected.

The vulnerability has a CVSS score of 7.8, indicating high severity, while the EPSS score is below 1%, suggesting a low current exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local; an authorized user must invoke the race condition by interacting with the TWINUI subsystem concurrently. When successful, the attacker can elevate privileges on the compromised machine.