A race condition in the Windows Push Notifications component allows a user with local access to trigger concurrent execution of a shared resource. The improper synchronization permits the attacker to elevate privileges on the affected system. Once privileges are elevated, the attacker can execute arbitrary code or modify system settings, effectively taking full control of the machine.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, 2025, and the 23H2 Server Core edition. All builds of the specified releases are impacted.

The CVSS score of 7.8 indicates a high severity vulnerability. Attackers need local, authorized access to exploit the race condition, which suggests the threat primarily impacts privileged users or users that can be coerced into executing code. No publicly available exploits were reported in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is not available; however, the high CVSS and the nature of privilege escalation still warrant prompt remediation.