The Windows SSDP Service contains a concurrency flaw where two processes access a shared resource at the same time without proper locking, creating a race condition. This weakness, categorized as CWE‑362, can be triggered by an authorized local user. The attacker can cause the service to perform privileged operations or execute code with elevated system rights, enabling the installation of software, modification of system settings, or other actions that compromise the machine’s integrity and security.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1, Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Server Edition are all affected.

This vulnerability carries a CVSS base score of 7, indicating a medium‑to‑high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires local access and an authorized user who can launch concurrent requests to the SSDP Service, and the attacker must time the race condition carefully. Once triggered, the service runs with system privileges, giving the attacker broad capabilities on the host.