The vulnerability is a race condition (CWE-362) in Windows Management Services caused by improper synchronization of a shared resource. Concurrent execution of conflicting operations can grant a local attacker temporary higher privileges, enabling the execution of code with system-level authority. This flaw allows a user who already has local access to trigger privileged actions that otherwise would be denied, leading to a full local privilege escalation.

Affected operating systems include Microsoft Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 22H3) and Windows Server 2019, 2022, 2025, and the 23H2 edition; both Desktop and Server Core installations are impacted. These build variants run on x86, x64, and arm64 architectures as specified by the CPE data.

The CVSS base score of 7.8 indicates high severity, and the exploit is considered to be local with no requirement for external network access. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local; an attacker who can initiate concurrent operations against Windows Management Services may trigger the race condition and elevate to system-level privileges, which can then be used to compromise the affected system.