A race condition in the Windows Device Association Service occurs because a shared resource is not properly synchronized. The flaw lets an authorized local user trigger concurrent execution paths that ultimately grant higher privileges. The issue maps to CWE-362 (Race Condition) and CWE-416 (Use After Free). The description limits the impact to privilege escalation and does not state broader code execution.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server 2016, 2019, 2022, 23H2, and 2025 editions, including both full and Server Core installations. All 32‑bit, 64‑bit and ARM64 configurations as listed in the CV are affected.

The CVSS base score of 7.0 indicates moderate severity, while an EPSS score below 1 % suggests a low likelihood of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an authorized local user who can execute the Device Association Service; no remote entry point is known, so the risk is confined to local accounts.