The vulnerability is a race condition that occurs when Windows Push Notifications processes concurrent requests to a shared resource without proper synchronization. An attacker who is already authorized on the system can exploit the timing flaw to gain higher privileges, effectively taking control of the local machine. The flaw is a classic example of a concurrency issue (CWE‑362).

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; Microsoft Windows Server 2019, Server 2022, and Server 2025 (including Server Core installations).

The CVSS base score of 7.8 indicates a high severity exploitation scenario. The EPSS score is not available, so the likelihood of immediate exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local and requires that the attacker already has some authorized user access. Once the race condition is triggered, the attacker can elevate privileges with potential full control over the system.