Concurrent execution using a shared resource within the Windows Push Notifications component leads to improper synchronization, creating a race condition. An authorized user can exploit this flaw to gain elevated local privileges, allowing them to execute code with higher rights than the account originally possesses.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 22H3; Microsoft Windows Server 2016, 2019, 2022, 2025 and 23H2 editions, including Server Core installations.

The vulnerability scores a CVSS of 8.8, marking it as high severity. EPSS data is not available and the issue is not included in the CISA KEV catalog. Exploitation requires an authenticated user with local execution rights; it does not provide a remote attack vector. An attacker must run code locally and trigger the race condition to achieve privilege escalation, potentially compromising system‑wide integrity and confidentiality.