This vulnerability is a race condition in the Microsoft Brokering File System caused by improper synchronization of a shared resource. The flaw allows a local attacker to intervene during concurrent execution, resulting in elevated privileges. The weakness is rooted in concurrency issues that let the attacker gain higher authority on the affected machine, potentially allowing further exploitation and compromising system integrity.

The affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2016, 2019, 2022, 2025, and 23H2, in both standard and Server Core editions. All these builds are listed as vulnerable in the Microsoft update guide.

The vulnerability carries a high CVSS score of 8.4, indicating significant risk. Although an EPSS score is not provided and it is not listed in the CISA KEV catalog, the severity points to a substantial threat if exploitation occurs. The attack vector is clearly local, requiring the attacker to have some level of presence on the target machine. Once the race condition is triggered, the attacker could elevate privileges to system level, thereby compromising confidentiality, integrity, and availability of the system.