A race condition in the Windows Push Notifications service allows a local, authorized attacker to gain higher privileges on the system; the flaw stems from improper synchronization when multiple threads access a shared resource, leading to a failed privilege check that can be exploited to elevate privileges. The vulnerability is identified by CWE‑362 (Race Condition) and CWE‑416 (Use After Free). The primary effect is a local privilege escalation that could enable an attacker to run arbitrary code as SYSTEM or another privileged account, thereby compromising the confidentiality, integrity, and availability of the affected system.

Microsoft Windows products from Windows 10 Version 1809 and 21H2 through Windows 11 Version 26H1, as well as Windows Server 2019, 2022, and 2025 (including Server Core installations) are impacted. All released builds of these operating systems that have not applied the vendor patch are vulnerable.

The CVSS v3.1 score of 7.8 indicates that the flaw is of high severity, offering local privilege escalation without remote access prerequisites. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been documented yet. The attack requires an authorized local user to trigger parallel access to the Push Notifications resource; if such conditions exist and the system is not patched, exploitation is straightforward with existing Windows debugging or scripting tools. Given the high CVSS score, the theoretical risk remains significant for unpatched systems, especially in environments where users have local administrator privileges or where the Push Notifications service runs with elevated rights.