The flaw in Windows User Interface Core arises from a race condition caused by improper synchronization of a shared resource, which an authorized local user can exploit to gain higher privileges. This CWE‑362 vulnerability allows the attacker to run privileged code, modify system settings, or otherwise access protected resources that should be restricted, thereby threatening confidentiality, integrity, and availability of the impacted system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; and Windows Server 2016, 2019, 2022, 2025, and the 23H2 Server Core edition are affected. All listed editions, whether standard or server core installations, are susceptible to the race condition when UI core components process concurrent requests.

The CVSS v3 score of 7.8 marks this issue as high severity; EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local authorized user who can interact with the UI core; no remote exploitation vector is known. Attackers are likely to trigger the race condition by rapidly issuing UI actions that compete for the shared resource, though the exact technique has not been disclosed. Given the local nature and elevated privileges achievable, organizations should treat this as a priority for patching.