This flaw is a race condition in Windows Local Session Manager (LSM) caused by improper synchronization when multiple processes access a shared resource concurrently. The vulnerability allows an attacker with local user privileges to manipulate the execution order of LSM operations, enabling them to gain higher privileges on the affected Windows system. The weakness falls under CWE‑362, representing a concurrent execution error that compromises system integrity by permitting unauthorized privilege elevation.

The vulnerability affects Microsoft Windows 10 (starting with version 1607 through 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 22H3), and a broad range of Windows Server releases including 2008 R2 SP1, 2008 SP2, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and the forthcoming 2025 editions. All architectural variants (x86, x64, arm64) are listed in the CPE data, indicating that the issue is present across the entire Windows desktop and server portfolio.

The CVSS score of 7 denotes moderate severity, and the EPSS score shows a very low exploitation probability (< 1 %). The vulnerability is not included in the CISA KEV catalog, meaning there are no confirmed widespread exploits at present. The attack vector is local; an attacker must already have physical or local user access to the target system. Exploitation requires precise timing to trigger the race condition, which limits the practicality of attacks under normal conditions.