The vulnerability is a race condition in the Windows kernel caused by improper synchronization of a shared resource. An attacker with local access can exploit this flaw to gain elevated privileges on the host. The weakness is classified as CWE-362, a concurrency bug that permits unauthorized privilege escalation when two threads or processes race to modify kernel state.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2 through 26H1 and 22H3; Microsoft Windows Server 2012 (Standard and Server Core), 2012 R2, 2016, 2019, 2022 (including the 23H2 Edition Server Core installation) and 2025 (including Server Core).

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% translates to a very low likelihood of exploitation in the broader population. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who already has local access to the target machine—such as a compromised local account, compromised application, or insider threat. Once executed, the race condition can be triggered by a crafted sequence of operations that causes the kernel to grant elevated rights to the attacker’s process.