A race condition exists within the Windows Push Notifications service. The flaw arises from incorrect synchronization of a shared resource, allowing an authorized local user to trigger concurrent notification processing and thereby obtain elevated privileges. The impact is a local privilege escalation that could enable an authenticated attacker to gain higher-level system access.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, 2025, and 23H2 editions, including both standard and Server Core installations. All supported CPU architectures—x86, x86‑64, and ARM64—are impacted.

The flaw carries a CVSS score of 7.8, classified as high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation has been reported. The attack vector is local, as the description specifies a local privilege escalation. Detailed exploitation steps are not provided in the CVE entry, so risk assessment is based on the high severity score and local nature of the attack.