A race condition involving shared resources in the Windows Push Notifications service can be exploited by an authorized local attacker. The flaw permits the attacker to elevate privileges and execute code with higher rights, potentially leading to full system compromise or unauthorized data access.

Affected systems include Microsoft Windows 10 versions 21H2 and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1, Microsoft Windows Server 2022, Windows Server 2025, and the Windows Server 23H2 Edition (Server Core installation).

The vulnerability scores a CVSS of 7.8, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, authorized access; the attacker must trigger the race condition by interacting with the push notification mechanism. Once exploited, the attacker gains higher privileges, increasing the potential impact across the affected systems.