A race condition in the Windows Win32K graphics subsystem allows an authorized local user to manipulate a shared resource, potentially causing unintended code execution under elevated privileges. The weakness resides in concurrent execution with improper synchronization, creating a scenario in which privilege escalation can occur. The vulnerability is identified as a local attack that could let a user gain higher permissions on the affected system.

The flaw affects Windows 10 releases 1607, 1809, 21H2, 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 22H3, and 26H1. In addition, Windows Server editions from 2012 through 2025, including Server Core installations, are impacted.

The CVSS score of 7 indicates a medium to high severity. The flaw requires an authorized local user and concurrent interactions with the graphics subsystem to trigger the race condition. No widespread exploits are currently documented, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local, with prerequisites of user presence and the ability to invoke the vulnerable Win32K component. The impact is elevation of privilege, which may allow further exploitation if additional techniques are employed.