The vulnerability is a time‑of‑check to time‑of‑use (TOCTOU) race condition in the Windows LUAFV (LUA File Virtualization Filter). When two concurrent operations access the same resource, an attacker can cause the system to elevate their privileges. This defect permits a local, authorized user to gain higher privileges, potentially reaching system or administrative level. The weakness is a classic race condition (CWE‑367).

The flaw affects Microsoft Windows operating systems and server editions. Specifically, Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Server Core edition. All builds listed in the vendor product list are vulnerable.

The CVSS score is 7.0, indicating a high severity vulnerability. No EPSS data is available, and the flaw is not yet catalogued in the CISA KEV list, so publicly known exploitation is currently unverified. Attackers must have local access and be authorized users; therefore exploitation is local. Nonetheless, the ability to elevate privileges can allow manipulation of system settings, installation of malware, or escalation to full control. Because the flaw is a race condition, it may be hard to reliably trigger, but once triggered it can cause immediate privilege increases. Organizations should treat this as a high‑risk local privilege escalation problem.