A race condition in Windows Management Services allows an authorized local user to gain elevated privileges. The flaw arises from concurrent execution of shared resources without proper synchronization, resulting in unintended access to privileged functionality. An attacker who can invoke the service dynamically can leverage this, potentially escalating from a standard user account to a higher privileged role such as administrator or system.

The vulnerability exists in Microsoft Windows 10 (versions 1809, 21H2, and 22H2), Windows 11 (versions 22H3, 23H2, 24H2, and 25H2), Windows Server 2019 (including Server Core installations), Windows Server 2022 (including Server Core installations 23H2), and Windows Server 2025 (including Server Core installations). All affected systems run the standard 64‑bit or 32‑bit builds listed by Microsoft.

The flaw carries a CVSS score of 7.8, indicating high severity, but its EPSS score is below 1%, suggesting the likelihood of exploitation is currently low. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local; an attacker must have the ability to influence the Windows Management Services process to trigger the race condition, typically requiring administrative or privileged local access. Once triggered, the attacker can elevate their privileges on the affected system.