A race condition in Windows HTTP.sys, described as a time‑of‑check time‑of‑use flaw, allows an authorized attacker to elevate privileges locally. The flaw arises from a timing discrepancy in handling HTTP requests that can be exploited to increase user privileges. It is classified as CWE‑367. Based on the description, it is inferred that the attacker must have local access and may be able to raise privileges beyond their original user level.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, 22H3, and 26H1; as well as Windows Server 2019 (standard and core), Windows Server 2022 (standard, core, and 23H2 edition), and Windows Server 2025 (standard and core).

The CVSS score of 7.8 indicates a high severity, yet the extremely low EPSS (< 1%) and absence from the KEV list suggest limited exploitation. It is inferred that local users can trigger the race condition to attempt privilege escalation. Systems allowing unrestricted local logins or with large user bases should prioritize patching to mitigate potential risk.