The Device Association Service in Windows contains a race condition that allows a locally privileged user to execute code with higher privileges. This flaw occurs when concurrent threads access a shared resource without proper synchronization, resulting in an elevation of privilege on the affected system. Because the vulnerability is identified as CWE‑362 (Race Condition), a malicious actor can manipulate the execution order to override security checks.

Affected operating systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 22H3, and 26H1. The same flaw also exists in Windows Server 2012 R2 (both standard and Core installations), 2016, 2019, 2022, and 2025 versions, covering both standard and Core configurations. All listed builds are vulnerable until the security update is applied.

The CVSS score of 7.0 indicates a high severity, but the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The flaw requires an attacker to have local authorized access to the system, so it does not pose an immediate remote threat. Nevertheless, because the vulnerability permits local privilege escalation, it remains a significant risk that should be remediated promptly.