A race condition in Windows Management Services enables a user with local, authorized access to exploit an improper synchronization mechanism, resulting in elevation of privileges on the affected machine. The flaw is characterized by a CWE‑362 race condition and CWE‑416 use‑after‑free weakness, allowing the attacker to gain higher permissions within the same system.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 22H3, 23H2, 24H2 and 25H2; Windows Server 2019, 2022 and 2025 including Server Core installations. Any affected edition running the Windows Management Services component is vulnerable.

The vulnerability scores a CVSS of 7.8, indicating High severity. EPSS is reported below 1 %, implying a very low probability of exploitation, and the issue is not in the CISA KEV catalog. The attack requires an attacker to have local, authorized access and invoke Windows Management Services concurrently. While the exploit path is not detailed, the race condition provides a deterministic privilege escalation for an attacker who can manipulate concurrent service operations, warranting prompt remediation.