This vulnerability results from a race condition in the Windows Push Notifications subsystem. Improper synchronization during concurrent use of a shared resource allows an attacker with local user privileges to manipulate notification processing and elevate their privileges. The issue involves both a race condition (CWE-362) and a use-after-free (CWE-416), enabling exploitation of privileged code paths.

Microsoft Windows 10 versions 1809, 21H2, and 22H2 are affected, as are Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1. Windows Server 2019, Windows Server 2022, Windows Server 2025, and their Server Core or 23H2 editions also contain the flaw.

The CVSS score of 7.8 denotes high severity. An attacker only needs local access with an authorized account to trigger the race condition; network connectivity is unnecessary. No publicly available exploits are currently documented and the vulnerability is not listed in the CISA KEV catalog, but the potential for privilege escalation remains significant. The attack vector is inferred to be local due to the requirement for an authorized attacker described in the official synopsis.