A race condition in Windows Management Services caused by concurrent use of a shared resource without proper synchronization allows an attacker who already has local system access to temporarily gain elevated privileges. The flaw is categorized as a concurrency error (CWE‑362), a use‑after‑free (CWE‑415), and a buffer overrun (CWE‑416). If successfully exploited, the attacker could run arbitrary code with higher system privileges, potentially compromising the entire operating system.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 22H3; Windows Server 2019 (including Server Core), Windows Server 2022, Windows Server 2025, and the 23H2 Server Edition (including Server Core). All x86, x64, and ARM64 builds listed in the affected CPEs are impacted.

The CVSS base score is 7.8, indicating high severity. The EPSS score is below 1%, implying a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker needs authenticated access to the machine or the Windows Management Services interface. Once authenticated, the race condition can be triggered, allowing privilege escalation. The combination of a high CVSS score and a low EPSS probability suggests a moderate to high risk level for systems where local users may have administrative or elevated permissions.