A race condition within the Windows User Interface Core allows an authorized local user to trigger a concurrency error, resulting in elevated privileges. The flaw stems from improper synchronization of a shared resource, enabling the user to bypass normal privilege restrictions and assume higher level rights on the system.

Affected are Microsoft Windows 10 build 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server 2016, 2019, 2022, 2025, and the 23H2 edition, including Server Core installations.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authorized local user to conduct specific UI operations that trigger the race condition; no public exploits are documented, so the likelihood of exploitation is moderate, but the potential impact is significant for any affected system.