The vulnerability arises from a race condition in the Windows Runtime processed during concurrent execution of shared resources. An authorized user who can execute code locally can exploit improper synchronization to manipulate privilege levels, thereby gaining elevated permissions on the system. The core weakness is a concurrency control flaw, aligning with CWE-362 and CWE-416 issues where shared resources are unsafely accessed.

Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Microsoft Windows Server 2025 in both standard and Server Core installations, are all affected by this flaw as listed by the CNA.

The CVSS score of 7.0 indicates a moderate to high severity impact, while the EPSS score of less than 1% suggests that exploitation is currently unlikely in public environments. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local authorized access to trigger the race condition, implying that protection against local code execution and ensuring packages are up‑to‑date limit the risk. Nevertheless, the potential for privilege escalation warrants promptly applying the defender’s patch to eliminate the flaw.