The Windows SSDP Service contains a race condition due to improper synchronization between concurrent executions of a shared resource. This flaw permits an attacker who has local authorized permissions to elevate privileges, potentially achieving full system control.

The vulnerability spans numerous Microsoft Windows releases, including Windows 10 1607, 1809, 21H2 and 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; and Windows Server 2012 (all editions), 2012 R2 (all editions), 6, 2019 (all editions), 2022, 2025, and the 23H2 edition of Windows Server. All affected builds are enumerated by the CNA.

With a CVSS score of 7, this issue is a high‑importance local privilege escalation. The description indicates that the attacker must already have local access to exploit the race condition, implying that remote exploitation is not supported. No known public exploits exist and the vulnerability is not listed in the CISA KEV catalogue. Still, once local privileges are gained, the flaw can serve as a foothold for further attacks.