The vulnerability is a race condition in the Windows Connected Devices Platform Service that allows an authorized local user to exploit improper synchronization of a shared resource, leading to local privilege escalation and the ability to execute code with elevated rights.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025 (including Server Core installations) are affected by this flaw.

The CVSS v3 score of 7 indicates a high severity potential, yet the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw requires an attacker to already be authenticated on the target machine, so the attack vector is local. Because the vulnerability is not listed in CISA’s KEV catalog, there are no known widespread exploit campaigns targeting it at this time.