A race condition occurs when multiple processes access a shared resource without proper synchronization within Windows Push Notifications. This flaw can allow an attacker who has local access to orchestrate concurrent operations that result in the elevation of their privileges. The vulnerability involves improper synchronization (CWE‑362) and a memory‑related discontinuity (CWE‑416), which together grant the attacker an elevated local privilege level, potentially enabling them to modify system settings, install malware, or otherwise compromise the affected machine. The flaw is limited to the local context and does not enable remote exploitation.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; Windows Server 2019, 2022, 2025 (both full and Server Core installations). The affected releases are listed as listed by Microsoft’s CNA and correspond to the Windows versions enumerated in the CPEs.

The CVSS score of 7.8 indicates a high severity vulnerability. A local attacker can readily trigger the race condition by executing appropriately crafted code on the machine. Because the EPSS score is not available, the exploitation probability cannot be quantified, but the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is inferred to be local execution; the problem requires the attacker to have elevated or privileged access to the target machine to cause the race condition.