An identified race condition targets Windows Management Services, allowing a local attacker with authorized access to exploit improper synchronization of a shared resource to gain elevated privileges. The flaw is most closely associated with the concurrency, double free, and out‑of‑bounds write weaknesses that enable an attacker to override or incorrectly manipulate service state. If successfully triggered, the attacker can run code with higher authority than the user or compromised application, potentially compromising the entire system or other users.

The vulnerability affects a broad set of Microsoft Windows releases, including Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, as well as Windows Server releases 2019, 2022, 23H2 Edition (Server Core), and 2025 (both full and Server Core installations). All listed architectures, including x86, x64, arm64, and for Windows 10 x86, are impacted.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is below 1%, indicating a very low probability of exploitation at the present time, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a local, authenticated user to trigger the race condition during concurrent use of Windows Management Services. The attack vector is local; the attacker must have some privileged or automated access to the target machine to race the shared resource and gain elevation.