A race condition in the Capability Access Management Service allows an attacker who can run code with local user permissions to force the service to grant higher privileges through improper synchronization on shared resources. The flaw relies on race timing and results in users successfully elevating their rights on the same machine, potentially enabling full compromise of the local account. This is a classic concurrency bug and a classic memory safety issue identified as CWE-362 and CWE-416.

Microsoft Windows 11 24H2, Windows 11 25H2, Windows Server 2025 and its Server Core installation are affected. The CVE data specifically lists the ARM64 and x64 variants of Windows 11 24H2 and 25H2 and all flavors of Windows Server 2025.

The CVSS score of 7.0 classifies the vulnerability as Medium-High severity, and the EPSS score of < 1% indicates a low estimated probability of exploitation at this time. The vulnerability is not present in the CISA KEV catalog. Though the attack requires local code execution, the provided description infers that any privileged user can exploit it by racing the service’s lock state; no remote vectors are described. An attacker already able to run code on the system can thus raise their privileges, which could lead to system-wide compromise.