A race condition in Windows Management Services allows a locally authenticated attacker to gain elevated privileges through improper synchronization of a shared resource. The vulnerability aligns with CWE‑362 for race condition and CWE‑416 for use‑after‑free. An attacker who can trigger concurrent access to the component can elevate their privileges to system level, compromising confidentiality, integrity, or availability on affected systems.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2 and 25H2; and Microsoft Windows Server 2019, 2022, 2025, including Server Core installations. These operating systems are vulnerable to the race condition in the management service.

The CVSS score is 7.8, indicating high severity. The EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors are local; an authorized user who can trigger simultaneous operations on Windows Management Services could exploit the flaw. No remote access is required, but the bug exploits a timing issue that can be triggered by an attacker who can run code or commands on the target machine.